MediaStash
Your private media, locked in a single encrypted file
A portable encrypted vault with built-in playback, decoy mode, and cloud backup. No temp files. No unprotected folders. No leaks.
Get on Google PlayEverything you need. Nothing exposed.
Media Stash isn't just a gallery locker. It's a full encrypted filesystem with built-in playback, management, and cloud sync.
Single Encrypted File
Your entire media collection lives in one .stash file — a portable encrypted container that acts as a secure virtual filesystem.
Built-in Playback
View photos and play videos directly inside the vault. On-the-fly decryption means nothing is ever extracted or cached in the open.
AES-GCM Encryption
Every file is encrypted in 1 MiB chunks using AES-GCM. PIN protection backed by PBKDF2 or Argon2 for brute-force resistance.
Decoy Mode
A secondary PIN opens a completely separate, harmless collection. Plausible deniability built right in.
Encrypted Cloud Backup
Sync your stash to your preferred cloud provider with end-to-end encryption. Pause and resume uploads anytime.
Organize & Manage
Folders, bulk rename, drag-and-drop organization, and one-click export. Full control over your library.
Security at every layer
Not an afterthought. Not a wrapper around someone else's library. Every byte is accounted for.
Chunked Encryption
Files are split into 1 MiB chunks, each independently encrypted with AES-GCM. Streaming decryption during playback — no full-file extraction, no plaintext on disk, ever.
Key Derivation
Your PIN goes through PBKDF2 or Argon2 before it touches encryption. Brute-force attacks are computationally impractical. You choose the algorithm.
Zero Residue
No temporary files. No thumbnail cache. No unprotected copies. Media is decrypted in memory, displayed, and discarded. Nothing lingers.
Plausible Deniability
Decoy Mode: a secondary PIN opens a separate, innocent-looking collection. There is no way to prove the real vault exists from the outside.