A little clarity goes a long way.

Qvlt is a local-first application for protecting sensitive files and sharing them with trusted, verified contacts. It is being hardened and prepared for release.

No Qvlt account is required for core file protection. Your cryptographic identity is created and used locally; it is not a sign-in to a Qvlt service.

Protecting a file does not require uploading it to Qvlt. If you choose email, cloud storage, or another delivery provider, you send the protected file through that service and its policies apply.

Yes. You can protect files for your own Qvlt identity and keep the protected files on storage you control.

No. Qvlt protects files. You choose where to keep or deliver the protected result, including local storage or a provider of your choice.

Yes. The intended recipient uses Qvlt and their own cryptographic identity to unlock the protected file. Receiving a file by email or another delivery service does not replace that requirement.

You select a verified cryptographic contact. An email address alone is not proof of identity. Contact verification is what connects a person's identity to the key you trust.

A contact whose cryptographic identity you have checked and chosen to trust. Qvlt supports an in-person QR pairing flow to help make this check straightforward. Only eligible verified contacts can be selected as recipients.

It describes cryptographic techniques designed to resist attacks from both classical and quantum computers. It is not a promise that an entire device or application is immune to attack.

ML-KEM-768 is the post-quantum key encapsulation mechanism used in Qvlt's recipient key protection. AES-GCM handles authenticated file encryption; these mechanisms do different jobs.

Core protection does not depend on a Qvlt account server. Keep your application, protected files, identity, and recovery material backed up appropriately. Future operating-system compatibility and continued software availability cannot be guaranteed.

Qvlt cannot recover secrets it does not possess. Keep the recovery material provided by the application safe and separate from your device. Do not assume that a protected file can be opened without the necessary identity or recovery material.

No public independent audit report has been published yet. The Security page will link to public assessments when they become available.

Qvlt is being prepared for Windows, macOS, Android, and iPhone / iPad. Check the download page for each platform's current release status.