iceland-2025.mp4
Pick a carrier file
A video, a photo, an audio file or a plain container of your own. Subfile writes the encrypted volume into it and leaves the original playable.
carrier = iceland-2025.mp4 · 4.21 GB · H.264
100% offlineNo accountNo cloudmacOS 15.4+
An ordinary file outside.
Your private drive inside.
Subfile turns a video, a photo or an audio file into an encrypted drive. It still plays, still opens, still looks like what it is — until you type your password.
subfile mount iceland-2025.mp4 — volume PRIVATE ready in 0.9s, 0 bytes written in the clear
Built for
- Freelancers
- Musicians
- Designers
- Photographers
- Developers
- Small studios
- Shared family Macs
- People who travel
Live demo
Same file.
Two contents.
A working preview of the real thing, running in your browser. Type anything as the password — the demo has nothing to protect.
- locked
- a 4.21 GB video that plays
- unlocked
- a drive named PRIVATE in Finder
- idle 5m
- unmounts itself, no prompt
iceland-2025.mp4
04:12 / 12:07H.264 · 3840×2160 · 4.21 GB4.21 GB
Vault locked.
open /Volumes/PRIVATE — 4 folders, 1 237 files, decrypted on read
How it works
Three steps. No manual.
No volumes, no partitions, no cipher menus. You pick a file, you drop things in, you set a password. That is the entire product.
Contracts
Unreleased
Passports
Drop your files in
Drag folders straight from Finder. Everything is encrypted before it ever touches the carrier — nothing is written in the clear, not even temporarily.
sealed 1 237 files · 0 bytes plaintext on disk
PRIVATE
Unlock as a drive
Type your password and the vault mounts in Finder like any external disk. Work normally, then eject. Idle for five minutes and it locks itself.
/Volumes/PRIVATE mounted · auto-lock 5m
Read this once
Copy it, rename it, sync it, put it on a USB stick. Just never let anything re-encode it — uploading a carrier photo to a service that recompresses images will strip the vault out. Subfile tells you which carriers survive what.
subfile new --carrier iceland-2025.mp4 — 3 steps, 0 config
Security
Real cryptography.
Honest claims.
Standard, boring, well-reviewed primitives — and a plain description of what hiding a volume inside a file does and does not buy you.
0
servers involved. Turn off networking entirely and every feature still works.
Under the hood
- cipher
- xchacha20-poly1305
- kdf
- argon2id · m=1GiB t=4 p=4
- integrity
- per-block AEAD + blake3 header
- mount
- fskit · userspace · no kext
01
Offline by design
No servers exist. Nothing to breach, nothing to subpoena, nothing to shut down.
02
No account, ever
No email, no licence server phone-home, no analytics on by default.
03
Nothing written in the clear
Files are encrypted in memory before they reach disk. No plaintext temp directory.
04
Open container format
The spec and the crypto core are public. Anyone can write a reader for your vault.
05
No password recovery
There is no backdoor to lose. That is the point, and it is also the risk.
06
Sandboxed and notarized
Ships through the Mac App Store. No kernel extensions, no installer scripts.
What Subfile does not promise
- A determined forensic examiner can spot an encrypted blob. Subfile is built to be unremarkable, not undetectable.
- A carrier is only as convincing as its size. A 40 GB “holiday photo” is a story that does not hold — put big vaults in big files.
- Lose the password and the vault is gone. Not delayed, not recoverable. Gone.
Carriers
What a vault can hide in.
Four carrier families, each tested against the tools that would break them. We tell you the ceiling instead of pretending there isn't one.
MP4MOVMKVBest choice
Nobody questions a 12 GB export. Video is the only carrier where a genuinely large vault still looks completely ordinary.
Plays in QuickTime, VLC and Finder preview, start to finish.
Recommended vault size
Up to 200 GBSurvives
- Copy, rename, moveYes
- External drives & USBYes
- File-level cloud syncYes
- Re-export or transcodeNo
Pricing
Pay once. Own it.
Privacy software you have to keep renting is a strange idea. Buy the app, keep the app.
01
Free
$0forever
Enough to prove it works with your own files.
- One vault, up to 500 MB
- All carrier formats
- Full encryption, no crippling
- Mounts as a real drive
Most picked02
Personal
$29one time
The whole app. Bought once, yours for good.
- Unlimited vaults, unlimited size
- Decoy vault with a second password
- Auto-lock, integrity checks, backups
- Free updates within 1.x
03
Universal
$49one time
For people who live on two operating systems.
- Everything in Personal
- Windows build when it ships
- Same vault opens on both
- Transferable licence
FAQ
The questions
worth asking.
Is there a subscription?
No. You pay once and the version you bought keeps working, offline, with no licence server to call home to. If a paid 2.0 ever happens, it will be an upgrade you can decline.
What happens if I forget my password?
The vault is unrecoverable. There is no reset link, no recovery key escrow and no support ticket that can help — that absence is exactly what makes the encryption meaningful. Keep the password somewhere you trust and keep a backup of the carrier file.
Can I open a vault without Subfile?
Yes. The container format is documented publicly and a reference command-line reader is open source, so your files never depend on this app continuing to exist.
Does the carrier file still work normally?
Yes — it plays, previews and opens exactly as before, and you can copy, rename, move or back it up freely. What breaks a vault is re-encoding: recompressing a photo, transcoding a video or repacking an archive rewrites the bytes the vault lives in.
Why macOS only?
macOS 15.4 introduced FSKit, which lets Subfile mount a real drive in Finder from userspace — no kernel extensions, no installer scripts, and it can ship through the Mac App Store sandbox. The Windows build is in progress and is covered by the Universal licence.
What do you collect?
Nothing. No account, no email required to run the app, no analytics enabled by default. Turn off networking entirely and every feature still works.
Every file can have
a private side.
Try it on one of your own files. It takes about thirty seconds to understand.
Free vault included · No account
subfile --version 1.0 · offline · no telemetry