🔒 I'm 13. No team. No funding. No support system. Just an HP 240 G9 and a lot of 2 AM debugging.
Most "founder story" posts start with a garage, a co-founder, and a seed round.
Mine starts with a laptop, a single Python file, and the very specific loneliness of Googling AES-GCM key commitment at midnight because there's no senior engineer to ask.
I'm Akhouri Anmol Kumar. I'm 13. And I've spent the last stretch of my life building ATLOCK — a real, working, Windows security suite — completely solo.
Today I'm putting ATLOCK v4.0 in your hands, and I want to talk you into breaking it.
🧠 What is ATLOCK, actually?
ATLOCK is a single-file, pure-Python security suite for Windows. No bloat, no 40-dependency Electron monster — one script, one purpose: lock down what matters on your PC.
Under the hood, it's not a toy: (ATLOCK v5 specifications 👇)
- 🔐 Argon2id + AES-256-GCM file & folder encryption, with key commitment and independent per-chunk authentication (so a doctored file can't silently corrupt you)
- 🗝️ A password vault with its own KDF, decoy-vault plausible deniability, and HMAC-chained tamper-evident audit logs
- 📸 Intruder detection — wrong password enough times, and ATLOCK silently photographs/records whoever's trying
- 🐤 A ransomware canary — decoy files that trip an alarm the moment something starts mass-encrypting your disk
- 🧷 A startup watchdog that flags new, unsigned autostart entries before they become a problem
- 📡 Remote alerts to your phone via Telegram when something's wrong
- 🎭 Windows Hello + TOTP 2FA, rollback-resistant lockouts, DPAPI-sealed local state
💻 The "no support" part isn't a sob story, it's context
I'm not saying this for sympathy. I'm saying it so the next part lands right:
- No mentor reviewing my crypto choices
- No team to catch my bugs before you do
- No budget for a code audit
- Just me, a mid-range laptop, documentation, and stubbornness
Which means v4.0 is the most tested I could make it alone — and also means you testing it, breaking it, and yelling at me in the comments is genuinely how this gets better. Not a nice-to-have. The actual mechanism.
⬇️ Get ATLOCK v4.0 right now
⬇️ Download ATLOCK v4.0 (.zip)
Run it. Encrypt a throwaway folder. Try to break the vault. Read the source and tell me what's naive. I mean it — that's the ask of this post.
🚀 What's already cooking for v5
v4 is the current flagship. v5 is where I'm going much further, and I want to build it loud, in public, instead of disappearing for six months:
- 🔑 Hardware 2FA — real FIDO2/WebAuthn support. YubiKey-class security keys as a second factor, not just TOTP.
- 🧱 A rebuilt cryptographic core with HKDF domain separation everywhere and stricter KDF ceilings so a malicious file can't burn your CPU/RAM.
- 🖥️ Deeper anti-tamper:
IsDebuggerPresent/remote-debugger checks, locked & zeroed memory buffers for key material. - 🧩 Automatic, safe migration from every older container/vault format — nothing you encrypted with v1-v4 gets left behind.
- 🛡️ Groundwork for TPM-backed key wrapping so your keys can eventually be bound to the actual hardware, not just your Windows login.
None of this is vaporware hype — it's actively being built, in the open, by one person who will absolutely take your feedback over ego.
🗣️ This is where you come in
I'm not asking you to just download and forget. I'm asking:
- What would make you actually trust a tool like this?
- What's missing that would make you switch from BitLocker/Bitwarden/whatever you use now?
- What in v4 looks weak, naive, or straight-up wrong to you?
Drop it in the comments, open an issue, roast the code — whatever gets it in front of me. Every single reply shapes what v5 becomes.
A 13-year-old with an HP 240 G9 built something real. Now help make it something great. 🔒
ATLOCK is an Akhouri Systems product.
Top comments (6)
Argon2id in pure Python is brutally slow, like seconds per hash on a laptop like that. Are you using a C binding under the hood or a real pure-Python port? Either way I'd want the measured KDF timings for the vault, since that's what decides if wrong-password attempts are actually rate-limited
Goood catch... — it's Argon2-cffi, which Binds to the Real compiled C libargon2, not a pure-Python implementation... Pure-Python argon2 would Be way too slow to be usable, so no, that's not what's under the hood.
@xulingfeng what do you think about v5
based on current specifications
it is already 80% built.
will be released soon.
Some comments may only be visible to logged-in visitors. Sign in to view all comments.