Ncrypt is an end-to-end secure file manager that offers encrypted local and remote storage, secure metadata management, and privacy-preserving search over encrypted data using fully homomorphic encryption (FHE). It is designed to give users complete control over their data, even in environments where the underlying storage or server infrastructure is not trusted.
Search functionality in ncrypt allows encrypted search queries to be evaluated directly over encrypted content without ever revealing the underlying plaintext. This ensures that even if a remote server is compromised, no sensitive information can be leaked. To protect the integrity and confidentiality of file contents, all files are encrypted using AES-256 before storage or transfer. For encrypted search and metadata processing, ncrypt uses concrete, a fully homomorphic encryption framework by Zama. Direct encryption and decryption of raw files is handled using the Python cryptography library.
Ncrypt follows the principle that users not platforms should control access to their data.
- End-to-end encryption of data at rest, in transit, and during computation ensuring compliance with privacy laws (GDPR, HIPAA, etc)
- Fully Homomorphic Encryption (FHE) powered search over encrypted metadata
- Quantum-resistant cryptography using AES-256 and secure key management
- Confidential cloud storage on untrusted infrastructure such as AWS S3
- Seamless local and remote modes with a unified command-line interface
- Integration with Huggingface models for embedding generation and intelligent metadata extraction
- Granular key wrapping and rotation per file to limit key exposure, with the ability to easily rotate keys
- Built-in shell interface with SFTP-inspired commands and tab completion
You can install ncrypt from PyPI using the following commands:
pip install -U pip wheel setuptools
pip install ncryptai
For developers, you can install ncrypt from source using the following commands:
pip install -U pip wheel setuptools
git clone https://github.com/ncrypt-ai/ncrypt.git
With pip
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
pip install -r requirements-dev.txt
pip install -r requirements-doc.txt
With conda
conda create -f environment.yaml
conda activate base
You can verify that ncrypt was installed successfully by running which ncrypt.
In order to run ncrypt, you must have:
python >= 3.11glibc >= 2.28On Linux, you can check your glibc version by runningldd --version.- Currently,
ncryptonly supports macOS 11+ and Linux
In its current state, ncrypt is intended to be used as a command line tool, and it supports a superset of the commands
utilized by the Secure File Transfer Protocol (SFTP). Ncrypt can be used both locally and remotely, with the remote mode
leveraging AWS S3 as the file storage backend. All configuration files are stored in the ~/.ncrypt directory.
To start ncrypt, run:
ncrypt [--remote]
After the ncrypt shell is running you can type help at any time to view a list of commands, or type quit to exit.
The following commands are currently supported by ncrypt. This is intended to be an overview of what each command does,
but does not specify the specific flags that each command supports. To view details about how to use a command, simply
add --help or -h after the command.
lls- List files in local directory.lcd <dir>- Change the local directory.lpwd- Print the current local working directory.lmkdir <name>- Create a directory in local file system.
ls [dir]- List all files in the virtual current working directory or the specified virtual directorycd <dir>- Change the current working directory in the virtual file systemmkdir <dir>- Create a virtual directoryrmdir <dir>- Remove a virtual directoryrm <file>- Remove a file and any of its associated metadatamv <src> <dst>- Move or rename a file or virtual directoryput <file> [dst]- Encrypt a local file and upload it to the virtual directoryget <file> [dst]- Download a file from the virtual file system to a local directory and decrypt it
rot- Rotate the Key Encryption Key (KEK) for all files in the virtual file system or rotate the Data Encryption Key (DEK) for a single filemeta <file>- Extract encrypted metadata from a file and upload it to the virtual file system. Run this command to make contents of a file searchable without decryptionsearch <dir>- Search for files in a given virtual directory by multiple available attributes such as name, date created/modified, and extension. This operation is not recursive. Also allows you to search over encrypted metadata using fully homomorphic encryption
Note: The meta and search commands can only be run in remote mode. When running in local mode there is no
significant performance cost associated with accessing the entirety of a files contents as it just requires decryption
of the file. As such, it does not make sense from a performance perspective to perform FHE operations directly on the
encrypted files.
pwd- Print the virtual current working directoryclear- Clear the terminal screenhelp- Show help for commandsquit- Exit the terminal
The ncrypt tool operates under the assumption that the host machine it is running on is safe and trusted. If that is
not the case, no piece of software will be secure, and you will have much bigger problems to worry about. However, we
make no such assumption about any of the cloud machines used by our remote file management backend (AWS S3) and ncrypt
is designed to be able to store and manage files securely on untrusted devices. The plain-text contents of your files
will never leave your machine.
While ncrypt was developed with performance in mind, Fully Homomorphic Encryption (FHE) is often orders of magnitude
slower than performing the same operations on plintext. The cryptographic keys necessary to perform operations directly
on encrypted data are also typically very large (on the order of hundreds of MB). As such, you will notice a significant
delay when you first start ncrypt as those keys are generated and the shared keys are uploaded. However, this is a
one-time operation and it will only occur when running in remote mode.
Some tips to improve FHE search performance:
- The search command runs only on the files that are direct descendants of the specified directory, and the run time of FHE operations will increase proportionally with the number and size of files in that directory. For faster searches, avoid having a flat directory structure by creating more folders
- Minimize search query length for faster encrypted evaluation
- Apply preprocessing to the files during metadata extraction. For example, rather than extracting all of the unique words in a document, you could summarize the document first, shrinking the search space
In the example below, we will open ncrypt in remote mode, create a directory, place two files in it, extract metadata
from each of those files, and perform a search over that metadata.
Directory creation and file placement
ncrypt --remote
(/) ncrypt> mkdir test_dir
(/) ncrypt> put /Users/me/Documents/a.docx test_dir/a.docx
(/) ncrypt> put /Users/me/Documents/b.docx test_dir/b.docx
(/) ncrypt> cd test_dir
Contents of a.docx
Hello world, how are you today?
Contents of b.docx
Lorem ipsum!
Metadata extraction
(/test_dir) ncrypt> meta a.docx --type text -sx
(/test_dir) ncrypt> meta b.docx --type text -sx
The above commands extract the raw contents of the specified file, indicating that they should be treated as text files.
The -x flag causes the files contents to be summarized, and the -s flag extracts each of the unique words from the
file, enabling encrypted keyword seach. If the -s flag were not provided, an embedding would be generated instead. The
output of this command is an encrypted array which is uploaded to the file management backend.
Encrypted search
(/test_dir) ncrypt> search ./ text "world" -s
(/test_dir) ncrypt>
(/test_dir) ncrypt> Contents of test_dir/ matching search parameters:
(/test_dir) ncrypt> a.docx
We firmly believe that products that claim to preserve privacy should be open-source, and that the community should be able to verify those claims. We welcome contributions to the codebase as well as bug reports and security audits that will help to ensure ncrypt remains secure.
For issues, questions, or feature requests, please open an issue on the GitHub repository or send us an email.
This software is distributed under the BSD-3-Clause-Clear license. See the LICENSE.txt file for details.