GitHub - jedisct1/turbocrypt: A fast, easy-to-use, and secure command-line tool for encrypting and decrypting files , git repositories and directory trees.

GitHub

4 min read Original article ↗

TurboCrypt Logo

A universal file encryption tool.

TurboCrypt encrypts anything from a single document to a whole directory of backups. You can also use it to open encrypted folders as local volumes or keep private files in a public Git repository.

  • Easy to use: create a key, then encrypt and decrypt files with a single command.
  • Small and portable: written in Zig and runs on Linux, macOS, Windows, and BSD.
  • Fast: processes files in parallel, whether you're working with a few documents or a large directory tree.
  • Modern cryptography: built on Argon2, AEGIS, HCTR2, and TurboSHAKE, with no insecure options.
  • Encrypted folders you can work in: mount a folder and use your usual apps to read and edit its files. The encrypted folder can be on your own disk or on remote storage you've connected to your computer.
  • Private files in Git alongside public code: commit encrypted notes, scripts, or unfinished work to Git, and optionally share the key with other maintainers who need access.

Install TurboCrypt

On macOS, install the signed universal binary with Homebrew. Trust the tap first, then install:

brew trust jedisct1/turbocrypt
brew install jedisct1/turbocrypt/turbocrypt

You can also download the archive for your system from the releases page, extract it, and put turbocrypt somewhere on your PATH.

If you'd rather build it yourself, install the master version of Zig, then run:

git clone https://github.com/jedisct1/turbocrypt.git
cd turbocrypt
zig build --release=fast

You'll find the program in zig-out/bin/. The getting started guide walks you through installation and your first encrypted files.

Encrypt your first folder

First, create a key and save it as your default:

turbocrypt keygen secret.key
turbocrypt config set-key secret.key

Keep a backup of secret.key somewhere separate from your encrypted files. You'll need that key to get them back, and anyone who has it can read them.

Now encrypt a folder, check the encrypted copy, and restore it to a new folder:

turbocrypt encrypt my-documents/ encrypted-documents/
turbocrypt verify encrypted-documents/
turbocrypt decrypt encrypted-documents/ restored-documents/

Your original files stay where they are. The same commands work on individual files, too.

Open an encrypted folder

On Linux and macOS, you can work with encrypted files through a normal folder:

mkdir -p ~/Volumes/documents
turbocrypt mount --daemon encrypted-documents/ ~/Volumes/documents

Open ~/Volumes/documents in your editor or file manager. When you're done, close the files and unmount it:

turbocrypt unmount ~/Volumes/documents

This uses FUSE and needs a one-time installation of fuse3 on Linux or fuse-t on macOS. After setup, you can mount your files without running TurboCrypt as root. On macOS, no kernel extension is needed.

For large files that change often, turbocrypt init creates a container made for random access. Files in it are read and written in encrypted chunks, so the mount keeps nothing in memory and has no file-size limit:

turbocrypt init encrypted-container/
turbocrypt mount --daemon encrypted-container/ ~/Volumes/documents

See Work with an encrypted folder for setup, remote folders, file-size limits, and containers.

Keep maintainer files in Git

From an existing checkout with a default key set, choose the files that should stay private:

turbocrypt git init
turbocrypt git add NOTES.md ops/
git commit -m "Add maintainer files"

You keep editing the files at their usual paths, while Git stores encrypted copies. Other maintainers can restore them with the key; everyone else sees the public project.

The Git guide covers setup, everyday commits, and restoring private files in another clone.

More things you can do