Lock any folder. It stays exactly where it is.
Encrypted where it already sits — same name, same path. Your ZapQR sign-in is the key.
Free to start · Now on Windows, too.
macOS · Windows · iOS · iPadOS · Android · AES-256-GCM
Reviewed, approved, and on the shelf
One account, one vault format, four stores.
iOS 17 or later. Free to download; Personal is an in-app subscription.
View on the App Store →macOS 14 or later. Full in-place unlock, for every app.
View on the Mac App Store →Production track, Data safety review cleared.
View on Google Play →Windows 10 (version 2004) or later. Lock from the right-click menu in File Explorer.
View on the Microsoft Store →Half a key on your Mac. Half on our server.
Neither half opens anything. They meet only in memory, on a device you have signed into. Play it through, or drag the timeline.
Ordinary files on an ordinary disk.
Your Mac
A P-256 private key held in the Secure Enclave. It is the only thing that can unseal this device's half.
deviceShare is not stored here — only the ability to unwrap it.
The folder
Encrypted files, plus one wrapped envelope per enrolled device.
recipients/<deviceId>.json — deviceShare sealed to that device's public key.
ZapQR sign-in
One value per vault, per device: serverShare. Released on a successful sign-in.
Signing in as you hands over no key material.
mk = deviceShare ⊕ serverShare Files AES-256-GCM, 64 KiB chunks Overhead 68 B + 28 B/chunk — 0.043% Envelope P-256, per device
The master key is assembled in memory and used there. It is never written to disk in full — not in the vault, not on our server, not in a backup.
Why it's not another vault
Disk images make you move your work somewhere else and remember it lives there.
The folder never moves
No disk image, no new drive letter. Everything already pointing at it keeps working — including your sync client.
We can't open your folders
AES-256-GCM, with the key split in two. We hold one half and it decrypts nothing. Files and file names never leave your device.
Take access back
Share with any ZapQR account on the Personal plan. Remove them and their next unlock is refused, and a folder they have open locks itself once their device hears.
One folder, every platform
Lock it on a Mac, open it on an iPhone, iPad or Android phone. One documented vault format, held to shared test vectors.
Your sign-in is the key
Not another account, another password, another app to trust.
ZapQR ──▶ ZapLock
End the session and every folder it opened locks.
ZapLock ──▶ your phone
No Face ID on this computer? Approve the unlock on your phone by tapping the matching number.
One account ──▶ every product
One account across ZapLock, your site and the DaSecure consoles.
What we hold, in plain terms
A free ZapQR account holds the server half of each key. Never your files. Never a whole key.
account identifier
device id + public key, per device
vault id + label, per folder
encrypted key share, per vault
unlock-check public key, if on
invites you send
plan + purchase records
security event log
your file names
a whole key
ZapLock, in short answers
Step-by-step answers for each platform are in the full FAQ, and more on the support page.
What is ZapLock?
ZapLock encrypts any folder in place on macOS, Windows, iPhone, iPad and Android. The folder keeps its name and its path, and you unlock it with your ZapQR sign-in. You can share a folder with another ZapQR account and take that access back at any time. It is free to download on the App Store, the Mac App Store, the Microsoft Store and Google Play. The Free plan locks one folder; Personal adds unlimited folders and sharing.
How is ZapLock different from a disk image or an encrypted vault?
Nothing moves. There is no disk image to mount, no vault folder to move your work into and no new drive letter. ZapLock encrypts the files where they already are, so aliases, recent-file lists, backup jobs and sync clients that point at the folder keep working.
Can ZapLock or DaSecure open my files?
No. Files are encrypted with AES-256-GCM on your device, and the key is split in two. The ZapQR account service holds one half, and that half alone decrypts nothing. File contents, file names and a whole key never leave your device.
Does ZapLock work with folders in Dropbox, Google Drive or iCloud?
Yes. You can protect a folder on your internal disk, on an external or USB drive, or inside a folder Dropbox, Google Drive or iCloud already syncs. Those services may still hold earlier unencrypted versions in their own version history, so clear that history with your provider if it matters to you.
What happens when I revoke someone's access to a folder?
Their next unlock is refused, and a folder they already have open locks itself as soon as the revocation reaches their device. If that device is offline, it locks once its offline timeout runs out.
Do I need an account to use ZapLock?
Yes, a free ZapQR account. It proves who you are and holds the server half of each folder's key. It never holds your files or a whole key.
Which platforms does ZapLock run on?
macOS, Windows, iPhone, iPad and Android, with one documented vault format, so a folder locked on a Mac opens on a Windows PC, an iPhone, an iPad or an Android phone. Windows needs Windows 10 (version 2004) or later.
Lock the folder you're already using.
Free to start on macOS, Windows, iPhone, iPad and Android. The folder keeps its name and its place.