DEV Community

Cover image for Zero-Storage, Self-Hosted Encryption: Meet File Locker Pro
iQuipe Digital
iQuipe Digital

Posted on

Zero-Storage, Self-Hosted Encryption: Meet File Locker Pro

#webdev #programming #devops #productivity

Most browser-based encryption utilities suffer from one of two design flaws: they silently upload your unencrypted data to an unverified third-party bucket, or they run heavy JavaScript in the client tab that chokes on files larger than a few megabytes.

File Locker Pro (iquipe/file_locker_pro) takes a different architectural approach. It is a self-hosted, containerized web service built on PHP 8.2 and Apache. Using PHP's native OpenSSL cryptographic engine, it provides stream-based authenticated encryption directly in a sleek, glassmorphic UI without retaining any plaintext on disk.

Here is an architectural breakdown of how it works and how to deploy it via Docker in under 60 seconds.

Cryptography That Does Not Cut Corners

File Locker Pro bypasses naive symmetric encryption in favor of authenticated constructions designed to prevent bit-flipping and padding oracle attacks:

  • Authenticated Ciphers (AEAD): Native support for AES-256-GCM, modern ChaCha20-Poly1305, and legacy AES-256-CBC + HMAC-SHA256.
  • Key Derivation (KDF): Derives keys using PBKDF2 over 100,000 rounds of SHA-256 with a 32-byte cryptographically secure random salt.
  • Tamper-Proof Headers (AAD): Binary .flocker file headers—storing the cipher ID, salt, and IV—are cryptographically bound as Associated Authenticated Data (AAD). Any byte manipulation in transit immediately fails MAC verification before decryption ever touches the payload.
  • Keyfile Flexibility: Supports standard user passphrases as well as generated 256-bit standalone key files (.flkey).

The Zero-Storage Lifecycle

The application operates on an ephemeral, stream-first pipeline:

No plaintexts are retained in storage. Files are handled via isolated, .htaccess-shielded temporary directories, bound to single-use download tokens, and unlinked from the filesystem immediately upon transmission.

Quick Start with Docker

You can pull and deploy multi-arch (amd64 / arm64) builds directly from Docker Hub.

Option 1: One-Liner via `docker run`

docker run -d \
  --name file_locker_app \
  -p 9980:80 \
  --restart unless-stopped \
  iquipe/file_locker_pro:latest
Enter fullscreen mode Exit fullscreen mode

Navigate to http://localhost:9980 to access the interface.

Option 2: Declarative `docker-compose.yml`

For production stacks running behind a reverse proxy (like Traefik, Caddy, or Nginx Proxy Manager):

services:
  file_locker:
    image: iquipe/file_locker_pro:latest
    container_name: file_locker_app
    restart: unless-stopped
    ports:
      - "9980:80"
    environment:
      - APP_ENV=production
    volumes:
      - file_locker_uploads:/var/www/html/uploads

volumes:
  file_locker_uploads:
    driver: local
Enter fullscreen mode Exit fullscreen mode

Spin it up:

docker compose up -d
Enter fullscreen mode Exit fullscreen mode

Key Built-In Tools

  • In-Browser Decryption Preview: Safely render plaintext images, PDFs, plain text, and audio streams inside the sandbox before saving them locally.
  • Header Inspector: Read and verify metadata blocks inside .flocker archives to confirm cryptographic integrity, cipher suites, and timestamps without disclosing secret keys.

File Locker Pro is distributed under the MIT License. Try it out on your local Docker daemon or homelab cluster.

Top comments (0)