Self-hosted encrypted media vault server — AES-256-GCM zero-knowledge encryption for photos & videos with a responsive local web gallery.
CryptHaven is a self-hosted media vault server that keeps your personal photos and videos encrypted at rest on your machine while serving a responsive local web gallery across your home LAN.
- 🗃️ Multi-Vault Launcher UI: Select, open, or transform any directory into a media vault from a single Windows GUI launcher.
- 🔒 Zero-Knowledge Encryption: All media is encrypted at rest using AES-256-GCM with Argon2id key derivation and a DEK/KEK key architecture.
- 📱 Responsive Local Web Gallery: Full-screen media viewer with pinch-to-zoom, touch navigation, auto-fading controls, and side-tap zone navigation.
- 🛡️ Configurable DRM & Download Controls: Toggle media downloading and saving permissions per vault session directly from the launcher.
- 🛑 Single-Instance Safeguard: Windows Mutex enforcement prevents duplicate server instances with a system-modal warning dialog.
- 🔄 System Tray Integration & Vault Switching: Switch vaults on the fly or manage server actions from the Windows system tray.
- 📁 Folder Management & Bulk Actions: Organize media into subfolders with multi-select bulk move, delete, and export.
- 🔍 Search & Duplicate Cleaner: Search files by name and identify duplicate files to reclaim storage space.
- ☁️ Google Drive Backup: Optional encrypted cloud backup for vault datasets.
- 🔑 Privacy & Access Security: Passcode authentication, CSRF protection, automatic 15-minute inactivity lock, rate-limiting, and HttpOnly/Secure/SameSite session cookies.
CryptHaven is designed with a strict zero-knowledge security model:
- Key Derivation: Argon2id (time_cost=3, memory_cost=64MB, parallelism=4) with unique 256-bit salt per vault.
- Key Architecture: DEK/KEK (Data Encryption Key / Key Encryption Key) — password changes are instant and never require re-encrypting media.
- Encryption: AES-256-GCM authenticated encryption for all media files at rest.
- Transport Security: Self-signed TLS 1.2+ certificates with HSTS for local HTTPS. HTTP automatically redirects to HTTPS.
- Web Security: CSRF tokens, secure HTTP headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options), rate limiting, HttpOnly/Secure/SameSite cookies.
- Path Traversal Protection: All file-serving endpoints use canonicalized path validation.
Note: CryptHaven is designed for local LAN use and should not be directly exposed to the public internet.
Download pre-built standalone binaries from the Releases section (CryptHaven.exe).
-
Clone the repository:
git clone https://github.com/BrannonSD/CryptHaven.git cd CryptHaven -
Install dependencies:
pip install -r requirements.txt
-
Launch the server:
python crypthaven_server.py
-
Open in Web Browser: Navigate to
https://localhost:8443. HTTP requests on port 8080 will automatically redirect to HTTPS.
CryptHaven v0.2.0 is backward compatible with v0.1.0 vaults. When you open a legacy vault (Fernet/AES-128-CBC), it will unlock normally. To upgrade your vault's encryption to AES-256-GCM, use the Migrate Vault option in the admin settings. Migration re-encrypts all media files in-place — make sure you have a backup before proceeding.
Customize CryptHaven using launcher toggles, environment variables, or CLI flags:
- CLI Arguments:
--vault-dir <path>: Directly launch the specified vault directory.--headless: Run in headless mode without opening the GUI launcher window.
- Environment Variables:
CRYPTHAVEN_PORT: Custom HTTP port (default8080).CRYPTHAVEN_HTTPS_PORT: Custom HTTPS port (default8443).CRYPTHAVEN_ALLOW_DOWNLOADS: Settrueto default-enable media downloads.CRYPTHAVEN_ENABLE_SHUTDOWN: Settrueto enable remote PC shutdown action.CRYPTHAVEN_MAX_UPLOAD_MB: Maximum file upload size in MB (default500).
This project is licensed under the MIT License - see the LICENSE file for details.
Maintained by BrannonSD