DEV Community

Akhouri Anmol Kumar
Akhouri Anmol Kumar

Posted on

I built a real NTFS-level file locker in Python — no password needed to protect, and even I can't brute-force it

Most "file lock" apps on the market do one of two things: rename your file extension, or hide it in a folder. Both take about ten seconds to bypass with Windows Explorer's search bar. That bugged me enough to build something that actually works at the OS level.

This is ATLOCK v4.0 — a total security suite for Windows, built in Python, and it's the fourth rebuild of a project I started from scratch after realizing the earlier versions weren't actually secure.

What it does

ATLOCK has five modules:

Lockdown — a system-level screen lock with a countdown timer (10 min to 8 hrs), designed for "step away from the laptop" moments.
File Guard — this is the core feature. It locks files at the Windows NTFS ACL level, not with a password wrapper. It literally rewrites the file's access control list so it's denied to every user, including SYSTEM if configured that way. Windows itself refuses to open the file — there's no password to crack because the OS is doing the blocking, not the app.
Password Vault — an encrypted store for emails, UPI IDs, and PINs.
Intruder Ops — if someone gets your master password wrong, the app silently takes a photo on the first wrong attempt, and after repeated failures, records a 10-second video — saved straight to your gallery, no cloud, no third party.
Settings — capture toggles and gallery folder control.
The security decisions that actually matter

A few things I rebuilt from earlier versions because they weren't good enough:

The vault used to store secrets with basic XOR "encryption," which is not encryption. v4 replaced it with Fernet (AES-128-CBC + HMAC).
The master password is derived using PBKDF2-HMAC-SHA256 with 200,000 iterations and a random salt per vault — slow by design, so brute-forcing it is expensive.
Every failed intruder attempt gets masked before it's ever logged, so nothing sensitive sits in plaintext on disk.
Alert credentials are stored encrypted with a machine-bound key, so copying the config file elsewhere doesn't help an attacker.

None of this is exotic cryptography — it's standard, well-reviewed primitives used correctly, which honestly matters more than anything clever.

Stack

Built with customtkinter for the UI (dark/gold theme, shown below), cryptography for Fernet/PBKDF2, pywin32 for the NTFS ACL manipulation, and opencv-python for the intruder camera capture. Packaged into a standalone .exe with PyInstaller.

Why this exists

I'm 13, this is a solo project, zero funding, and it's already been through four full rebuilds because "good enough" kept turning out to not be good enough. Akhouri Systems — the company behind it — exists on the idea that a lot of everyday software stopped getting properly maintained, and small teams (or one very stubborn person) can still fix that.

If you're on Windows and want file security that doesn't rely on security-through-obscurity, give it a look:

👉 https://akhouri-anmol-kumar.github.io/Akhouri-systems/
👉 https://github.com/Akhouri-Anmol-Kumar/ATLOCK

Feedback, bug reports, and brutal honesty are all welcome — that's genuinely how the last three rebuilds happened.

"We build what others forgot to fix." — Akhouri Systems

Top comments (0)