The PhotonFile verifier is a public tool for checking an encrypted file exported from Vault. With the export and its matching key, you can check the encrypted content and its structure on your own computer, then optionally decrypt a readable copy.
We publish it so you can inspect and read an exported copy outside the Desktop app. The public tools, source code, and file-format specifications make those checks open to examination. Once you have the export, key, and tools, you do not need to reconnect to your Vault to verify or decrypt that copy.
This checks a specific exported copy, not every aspect of PhotonFile's security. It does not prove who authored the file or that it is the latest revision. Choose the browser or Linux guide below to perform the same content-and-layout checks.
Verification checks the encrypted export. Decryption creates a readable copy. You do not need to decrypt it to get a verification result.
.pfv: the encrypted export package..key.json: the matching secret key file, sometimes
called a sidecar.
Use the pair from the same completed export. A regular downloaded file or a Vault share link is not an export package. If someone already gave you both files, you can choose a guide below. You do not need to export them again.
Keep the key file private. Anyone with the package
and its .key.json can decrypt that revision, even after
their PhotonFile access is revoked. Treat a decrypted copy as
sensitive too.
No verifier installation, Python, or GnuPG required. Select your two local files in the hosted application. Packages must be no larger than 256 MiB.
Processing stays in the browser tab, but the application is loaded from the live PhotonFile website.
Follow the browser guideFor Linux x86-64 with Python 3.9+ and GnuPG. Authenticate the tools before installing them, then verify with the native command-line reader.
Use this path for packages above 256 MiB or to run authenticated tools separately from the live website. An installed local-browser option is included.
Follow the Linux guideCreating a verification export requires the desktop application. Receiving an existing pair does not require exporting again.
.pfv and
.key.json shown in that dialog, then
choose either guide.
Expected result: two completed files whose names include the Vault and object identifiers and revision. Use the actual paths displayed by Desktop, not example filenames from a guide.
Folders, multiple selections, legacy vault version 0 files, pending uploads, deleted items, and unsupported archive sizes are ineligible. Windows and macOS export are not currently available.
Cancelling, locking the Vault, switching accounts, or changing access context can stop an export. Do not use an incomplete pair. Preserve uncertain outputs and follow Desktop's recovery instructions. Retrying in the same destination can recover incomplete operation-owned files. Do not manually delete a completed export to clear a recovery warning.
Content and layout verified means the encrypted content and its structure passed the checks using the matching exported key. It does not prove who authored the file, when it existed, or that it is the latest revision.
Protected metadata, original key wrapping, and external freshness remain unverified by the public content-key reader. For example, the result does not independently authenticate the file's protected metadata or prove that the server still grants access. It is not the author's digital signature.
These are PhotonFile-published tools, not an unaffiliated audit. Read about the trust model and release evidence.
Desktop authenticates protected metadata, the file-key envelope, descriptor, and chunks during export. The server checks the authorized snapshot at final validation, but that does not extend authorization through local publication or revoke exported copies later.
The hosted application loads inventory-authorized files. After readiness, it makes no processing requests and does not upload selected files or keys. It uses no telemetry, marketing scripts, service workers, or persistent storage for your files and keys.
Existing website cookies may accompany initial application requests. Other same-origin code, browser extensions, or a compromised website or computer can affect confidentiality. Security headers are not an independent trust boundary. The authenticated local bundle separates processing from the live website, but still requires a trustworthy computer and browser.
Release signatures identify the PhotonFile publisher, not an independent auditor or the author of your exported file. The source archive and signed evidence identify the release's source inputs.
Most users should follow one of the guides above. These links come from validated release metadata. Linux setup needs Python 3.9+ and GnuPG.
Release 0.1.5
Release primary fingerprint:
65988DFA88F70DC1704F196E19283DA08E1FEDAD. Authenticate it independently before running downloaded setup
code.
Related: Vault upload and download guide, Vault security documentation, and security disclosure policy.