YukkaiVault — Folder Encryption

Overview

YukkaiVault encrypts entire folders on your Mac using AES-256-GCM authenticated encryption — the same standard trusted by banks, militaries, and cloud providers. You can combine multiple authentication factors (passphrase, BIP-39 mnemonic, TouchID) so that no single credential alone can unlock your data.

Unlike simple password-protected archives, YukkaiVault supports Shamir Secret Sharing — splitting the decryption key into fragments distributed across trusted parties or locations. A configurable threshold of fragments must be reassembled to decrypt.

How it works

1. You select a folder to encrypt.
2. You choose one or more authentication methods (passphrase, BIP-39 mnemonic, TouchID, or combinations).
3. YukkaiVault generates a strong encryption key and encrypts every file in the folder with AES-256-GCM.
4. The key is sealed by your chosen authentication factor(s).
5. The original folder is replaced by a .yukkaivault file — an encrypted container.
6. To decrypt, you provide the same authentication factor(s) and specify an output path.

Encryption algorithm

• AES-256-GCM — provides both confidentiality (nobody can read the data) and authenticity (nobody can tamper with it undetected).
• Each encryption operation uses a unique initialization vector, so identical files produce different ciphertexts.

Authentication methods

Method	What it is	Best for
Passphrase	A password you choose (min. 12 characters)	Quick, everyday protection
BIP-39	A mnemonic phrase of 15/18/21/24 random words generated by YukkaiVault	Long-term recovery & cross-device portability
TouchID	macOS biometric authentication via the Secure Enclave	Convenient daily access on your Mac
Combinations	e.g. touchid+bip39, passphrase+bip39	Multi-factor security — no single factor unlocks the vault

Shamir Secret Sharing

When you enable fragmentation, the encryption key is split into N fragments using Shamir's Secret Sharing scheme. You choose a preset:

Preset	Fragments	Required to decrypt
2of3	3	Any 2
3of5	5	Any 3
4of7	7	Any 4

Fragments are saved as separate .yukkaifrag files. Distribute them to trusted people, cloud storage, or physical safes. As long as the threshold number of fragments can be collected, the vault can be decrypted — even if some fragments are lost.

How to use it

Encrypt a folder

Tell Yukkai in plain language:

"Encrypt my project folder at ~/Documents/SecretProject"

Yukkai will ask you to choose:

• A vault name (used for the output filename)
• Authentication method(s) — passphrase, BIP-39, TouchID, or a combination
• Fragmentation preset — none, 2of3, 3of5, or 4of7

If you choose BIP-39, Yukkai generates a mnemonic phrase for you. Save it somewhere safe — it is your recovery key and cannot be regenerated.

Decrypt a vault

"Decrypt the vault at ~/Documents/SecretProject.yukkaivault into ~/Decrypted"

Provide the same authentication factor(s) you used during encryption. If you used Shamir fragmentation, you'll need to provide the paths to the required fragment files.

Inspect a vault (without decrypting)

"Inspect the vault at ~/Documents/SecretProject.yukkaivault"

This shows metadata — vault name, encryption algorithm, authentication methods used — without revealing or decrypting any data.

Generate a strong password or mnemonic

"Generate a 24-character password with special characters"

"Generate a 24-word BIP-39 mnemonic"

Useful for creating passphrases or recovery phrases independent of a vault operation.

Examples

Example 1 — Simple passphrase encryption

"Encrypt ~/Desktop/TaxDocs with a passphrase, no fragmentation."

Yukkai prompts you for a passphrase (12+ characters), encrypts the folder, and produces TaxDocs.yukkaivault.

Example 2 — Multi-factor with Shamir

"Encrypt ~/Documents/CompanyData using touchid+bip39, with 3of5 fragmentation."

Yukkai:

1. Generates a 15-word BIP-39 mnemonic (you save it).
2. Enables TouchID via the Secure Enclave.
3. Splits the key into 5 .yukkaifrag files.
4. Produces CompanyData.yukkaivault.

To decrypt later, you provide TouchID plus the mnemonic plus any 3 of the 5 fragment files.

Example 3 — Decrypting with fragments

"Decrypt ~/CompanyData.yukkaivault into ~/Restored using fragments at ~/frag1.yukkaifrag and ~/frag2.yukkaifrag and ~/frag3.yukkaifrag."

Tips & best practices

• Always back up your BIP-39 mnemonic. If you lose it and chose bip39 as your only method, the vault is permanently unrecoverable. Write it on paper, store it in a physical safe, or use a metal backup plate.
• Use multi-factor for critical data. Combine passphrase+bip39 or touchid+bip39 so that a single compromised credential cannot unlock the vault.
• Distribute fragments geographically. If using 3of5, keep 2 fragments locally, 2 in cloud storage, and 1 with a trusted person. This protects against device failure, theft, and loss.
• Test decryption before deleting originals. After encrypting, verify you can decrypt and that all files are intact before removing the original unencrypted folder.
• Passphrases must be at least 12 characters. Longer is better. Use a generated password if you don't want to invent one.
• TouchID is Mac-only. Vaults encrypted with TouchID as a factor can only be decrypted on the same Mac (or one with your biometric profile). Always pair it with a portable factor like BIP-39 if you need cross-device access.
• Inspect before decrypting. If you forget which authentication methods you used, the inspect action shows you without exposing data.
• Fragment files are useless individually. A single .yukkaifrag file contains only a partial key. It cannot be used alone to access your data.