| Best suited for |
Personal files on shared or managed machines — zero-install, browser-only, no disk traces |
Large encrypted volumes on own hardware; plausible deniability |
IT-managed Windows with full-disk encryption and central key recovery |
Encrypting files before syncing to cloud (Dropbox, Google Drive, OneDrive…) |
| Cross-platform |
✅ Any browser — Windows, macOS, Linux, Android, iOS |
🟡 Desktop only — Windows, macOS, Linux |
❌ Windows only |
✅ Windows, macOS, Linux, Android, iOS |
| No installation |
✅ Zero install, runs in the browser |
❌ Requires system installation |
❌ Windows Pro/Enterprise only |
❌ Requires a desktop or mobile app |
| Admin / root rights |
✅ None required |
❌ Required for mounting |
❌ Required |
🟡 None on Windows/iOS; macOS needs macFUSE; Linux needs FUSE |
| Encryption algorithm |
✅ AES-256-GCM — authenticated encryption; every ciphertext has an integrity tag |
✅ AES / Twofish / Serpent (configurable) |
🟡 AES-128/256 XTS — no authentication tag |
✅ AES-256-GCM per file |
| Key derivation |
✅ Argon2id — memory-hard; GPU brute-force is expensive |
🟡 PBKDF2-SHA-512 / Whirlpool — not memory-hard; GPU-crackable |
🟡 TPM-bound; password KDF is comparatively weak |
✅ scrypt — memory-hard; comparable to Argon2id |
| Per-item authentication |
✅ GCM tag per chunk — tampering always detected |
❌ Block-level only; no per-file MAC |
❌ XTS provides no authentication |
✅ GCM tag per file |
| Portable container |
✅ Single .safenova file — copy anywhere, open anywhere |
🟡 Single container file, but fixed pre-allocated size |
❌ Tied to the Windows NTFS partition |
🟡 Folder of encrypted files — portable, but not a single archive |
| File stealer protection |
✅ Encrypted in IDB; never plaintext on disk |
❌ Mounted volume exposes all files to every process |
❌ Once unlocked, all files accessible to all processes |
🟡 Encrypted on disk; plaintext only in the virtual drive while open |
| Session / key management |
✅ Three-source HKDF wrap key; tab + browser sessions; cross-tab invalidation |
❌ Key in RAM while mounted; no session concept |
❌ TPM-derived at boot; no session control |
❌ Key in memory while open; no session tokens or expiry |
| Duress / emergency wipe |
✅ Duress password silently destroys the container |
❌ Not supported |
❌ Not supported |
❌ Not supported |
| Runtime anti-tamper |
✅ SafeNova Proactive — native API restoration, 20+ hooks, quadruple watchdog |
🟡 N/A — native binary; no browser JS attack surface |
🟡 N/A — same |
🟡 N/A — same |
| Content Security Policy |
✅ Strict CSP (meta tag + server headers); blocks inline scripts and external loads |
🟡 N/A — browser mechanism; not applicable to native apps |
🟡 N/A — same |
🟡 N/A — same |
| Integrity scanner |
✅ 28 automated checks (VFS + DB); auto-repair; decryption verification |
❌ No built-in scanning |
❌ No per-file integrity |
🟡 Detects corrupt files; no automated repair |
| Export / backup |
✅ One-click export as .safenova or ZIP |
🟡 Container file is portable but fixed size; no incremental backup |
❌ Cannot export; tied to the Windows volume |
✅ Files sync individually — cloud acts as continuous backup |
| Data deletion |
✅ Blob shredding + full IDB purge on delete |
🟡 Delete the file; OS journaling may retain fragments |
❌ Decryption leaves files; separate secure-erase needed |
🟡 Delete the vault; journaling applies; cloud may retain versions |
| Code auditability |
✅ Open source; plain JS; no build pipeline |
✅ Open source; multiple independent audits |
❌ Closed source; no audit possible |
✅ Open source; independent audits conducted |
| Performance at scale |
🟡 Good for typical files; slower than native for bulk operations |
✅ Native + AES-NI; minimal overhead |
✅ Kernel driver + AES-NI; transparent to the OS |
✅ Native; per-file overhead is minimal; handles large libraries |
| Targeted attack protection |
🟡 Blocks JS injection; limited against full-OS compromise |
🟡 Anti-forensic; cannot stop OS-level keyloggers |
❌ TPM bus sniffing (Evil Maid) is a known vector |
🟡 No special runtime protection; same OS-level limits |
| Storage size |
❌ Max 8 GB per container; IDB quota applies; not for large or industrial-scale data |
✅ Disk-only limit; terabyte-scale supported |
✅ Full drive at any capacity |
✅ No built-in limit; disk / cloud quota only |
| Hidden volumes |
❌ Not supported |
✅ Hidden volumes + hidden OS partition |
❌ Not supported |
❌ Not supported |
| OS / filesystem integration |
❌ Browser sandbox only; no virtual drive mount |
✅ Mounts as a real drive letter; full shell integration |
✅ Transparent OS encryption; Group Policy; BitLocker To Go |
✅ Mounts as a virtual drive (WebDAV / FUSE) |
| Multi-user access |
❌ Single user per container |
❌ Single user at a time |
🟡 Multiple recovery keys; enterprise AD deployment |
❌ Single shared password; per-user control requires Cryptomator Hub (separate server) |
> ### Try it online: [https://safenova.dosx.su/](https://safenova.dosx.su/)
SafeNovaEnterprise