Two areas, one program: On the left you encrypt text messages for your contacts. On the right you manage your personal, encrypted file vault.
Features
Six layers. Unbreakable security.
01
Rotor Machine
Unicode-capable with up to 100 rotors, 65,536 characters and fully randomised plugboards, reflectors and rotor positions — every message unique.
Unicode · 1-100 Rotors · 65,536 Chars
02
AES-256-GCM
The rotor ciphertext is encrypted with AES-256 in Galois/Counter mode. GCM provides both encryption and authentication — any tampering is detected and rejected.
AES-256-GCM · Authenticated Encryption
03
HKDF-SHA3-256
Fresh keys are derived for each message via HKDF with SHA3-256. The key rotates after every message (Perfect Forward Secrecy).
HKDF · SHA3-256 · Perfect Forward Secrecy
04
Argon2id
Password hardening with 64 MB RAM, 3 iterations, 4 threads. A 12-character password means over 1,000 years of brute-force time. GPU and ASIC attacks are structurally neutralised.
Argon2id · 64 MB · 3 Iter. · 4 Threads
05
Split Key
When establishing a connection, each side generates a unique 256-bit random ID. Only when both IDs come together is the shared key formed — combined with ECDH (Curve25519). Neither party alone can compute it.
Split-Key · ECDH · Curve25519
06
Forward Secrecy²
After the key exchange, the contact ID is irrecoverably deleted. Even if all files and source code become known later — past messages remain protected forever.
Forward Secrecy · No static keys
🔒
Replay Protection
Each message decryptable only once. Replay attempts detected and blocked immediately.
🛡️
Bootstrap Protection
Circular HMAC dependency — mathematically unsolvable.
📴
Fully Offline
No internet. No servers. No cloud. No account.
🔑
Local Keys
Key files never leave the device.
🌐
Unicode Support
All 65,536 Unicode characters. All 15 languages.
📱
Desktop & Mobile
Identical keyfile format on Windows and Android.
Security
Your password is never stored
The program password itself is never written to disk — neither in plaintext nor encrypted. Instead, every time you enter it, it goes through a deliberately intensive hardening process called Argon2id before anything else is done with it.
What Argon2id does: Unlike a simple hash, Argon2id is deliberately designed so that each individual password check requires noticeable computation time and a large amount of working memory. For you as a legitimate user, this is barely perceptible when unlocking normally. For an attacker who wants to try millions or billions of passwords automatically, this effort becomes an insurmountable barrier — each single attempt costs them the same time and memory as it costs you.
Your password does not produce a single directly usable key. Instead, several independent key parts are combined to derive the actual secret key. This combined key is practically impossible to guess or compute in reverse — even with considerable computational effort in any relevant timeframe.
This means: If your password is lost, it cannot be recovered by anyone — not even by the developer. It simply does not exist anywhere in a form from which it could be derived.
Quantum computers: Even an idealised quantum attack (Grover's algorithm) only halves the exponent of the already astronomically large key space — the required computation time remains many multiples longer than the age of the universe.
Military Deletion
When you delete a file from the vault, it is not simply moved to the recycle bin or marked as "free" storage space — it is actively destroyed. RotorCrypt X overwrites every byte of the file multiple times according to the military standard DoD 5220.22-M before releasing the storage space.
What this means: Normally deleted files can be recovered with freely available tools in minutes. A file deleted according to DoD 5220.22-M is irrevocably destroyed — not recoverable even with forensic means.
The standard requires several overwrite passes with defined patterns. After the final pass, the original file no longer exists on any storage medium in any readable form.
Note: This process is permanent. A confirmation dialog appears before each deletion. There is no way to recover a deleted file — not even by the developer.
Encryption
Every file in the vault automatically passes through four mutually independent encryption layers when added. No step can be skipped — all four must be traversed in the correct order with the correct key to restore the file.
The four layers: AES-256 → Rotor method → AES-256 → ChaCha20. Even if one layer could theoretically be broken, the remaining three fully protect the file.
AES-256 is the worldwide encryption standard — used by governments, militaries and banks. ChaCha20 is a modern algorithm specifically developed against side-channel attacks. The rotor method adds an additional, mathematically independent layer.
For you as a user: You don't need to configure anything. Every file is automatically encrypted when added and automatically decrypted when opened — visible only within the app.
Vault
The Vault is a fully encrypted storage area for files and folders — independent of the messaging section. Every file added to the Vault is automatically encrypted in three independent layers. This is the default because it already provides a level of protection that cannot be broken with current or foreseeable future technology — even with vast computing power, an attack attempt would take longer than would ever be worthwhile. A switch can be used to additionally activate a fourth protection layer. When the switch is on, a red frame appears around the DND field to indicate this. This fourth layer makes the file even more resistant, but increases its size by around 167% of the original, and encryption and decryption take correspondingly longer as a result. It is intended for particularly sensitive data where maximum security matters more than speed and file size. The switch is automatically reset to the default of three layers at the start of every new session.
Anonymity: In the vault, neither the original name nor the real file extension is visibly stored in the filesystem — the real name is only displayed inside the app.
Storage location — automatically right next to the program
RotorCrypt X-Files automatically creates the vault in its own subfolder directly next to the program file on first launch, without any prompts. Nothing needs to be selected or configured.
Portable by default: Since the vault is located relative to the program directory, it automatically moves along when the entire program folder is copied to another location — including a USB stick. Unlike a fixed path, it doesn't matter which drive letter (D:, E: etc.) the stick is assigned on a given computer — the program finds its vault automatically on every launch, without any reconfiguration.
This means: When the entire program folder is copied to a USB stick, both the messaging section (see section 15) and the vault are fully mobile from the start — on any Windows computer, without installation.
Manage Files & Folders
Copying in
Drag files or entire folders via Drag & Drop into the marked area "Drop files & folders here". Subfolders are preserved as real, nested vault folders.
Encryption time as reference: 1 MB approx. 20 sec., 10 MB approx. 2 min., 70 MB approx. 11 min. — depending on computer performance.
Moving
Drag a file or folder with the mouse onto another folder tile — the item will be moved into that folder. Via the right-click menu "Move to root directory" an item returns to the top level.
Renaming
Right-click on a file or folder → "Rename". For files, the real file extension is always preserved — only the name part can be changed. If the new name already exists, a notice appears and the input field reopens.
Deleting
Right-click → "Delete", or select and use the toolbar button "Delete file / folder". After confirmation the file is irrevocably overwritten according to DoD 5220.22-M — no recovery possible.
Create RCX File
A .rcx file can only be opened by the one contact it was created for. This is possible because both sides have completed their handshake — this makes the connection 100% secure, and messages or files can be exchanged safely. The file is also protected against tampering: if it is altered in transit, the program detects this immediately when opening it and refuses to decrypt it. The file can be sent using any program or messenger, as long as its size stays within that app's limits. To decrypt it, the sender must be in the recipient's contact list; the recipient selects that contact and then clicks "Decrypt RCX" — only then is the file decrypted and saved to a folder of their choice.
Mandatory requirement: An RCX file can only be created for contacts with whom the handshake is fully completed (green banner, status x03). If the handshake is not complete, the following window appears and the process is aborted:
1
Select the contact the file is intended for in the vault area.
3
Select any file from your computer (outside the vault).
4
Select the destination folder for the finished .rcx file.
1
Create contact
Keyfile is created automatically.
2
Exchange keyfile
Exchange securely with the partner once.
3
Handshake
Green banner: full security active.
4
Communicate
Encrypt, send, done.
5
Create RCX file
Select a file outside the vault and send it encrypted.
Decryptable multiple times: Unlike the one-time message block, an RCX file can be opened by the recipient any number of times.
Decrypt RCX
2
Select the received .rcx file.
3
Select the save location for the decrypted file.
1
Decrypt RCX
Click the button.
2
Select RCX file
Select the received .rcx file.
3
Choose save location
Target folder for the decrypted file.
Failed? An RCX file can only be opened with the contact it was encrypted for. If an error window appears, either the wrong contact was selected, the file is corrupted, or the handshake with this contact was not completed when it was created.
Self-Extracting EXE
Alternative to the RCX file when the recipient does not have RotorCrypt X-Files installed: A standalone .exe file that only asks for a password when opened — without the recipient needing to install any software.
2
Select the source file from your computer.
3
Set a password (min. 15 characters, with upper/lowercase letters, digits and special characters) and optionally an expiry date.
4
Select the save location for the finished .exe file.
| Property | Description |
|---|
| Encryption | Argon2id key derivation + AES-256-GCM |
| Failed attempts | 5 failed attempts → automatic self-wipe of the file |
| Expiry date | Optional: 1 day, 3 days, 7 days, 14 days, 1 month or never |
Expiry means deletion: After the chosen period expires, the file is immediately and irrevocably deleted on the next opening attempt (DoD 5220.22-M).
Technology Explained
AES-256 is the global encryption standard, used by governments, banks, and the military.
RotorCrypt X-Files also uses ChaCha20, a modern cipher originally designed for high speed on all devices and strong resistance to side-channel attacks, where an attacker tries to learn secrets from effects like timing or power usage rather than breaking the key directly.
Combining AES-256 and ChaCha20 in independent layers means an attacker must break both at once, not just one.
Argon2id additionally protects the password itself: unlike a simple password hash, each check deliberately requires significant time and memory, making automated password guessing practically infeasible.
Perfect Forward Secrecy ensures a fresh, one-time key is generated for every message, so even if a single key were ever exposed, all previous messages remain protected.
RotorCrypt X-Files and VPN – What's the Difference
A VPN encrypts the connection between your device and the internet, protecting the transmission path.
RotorCrypt X-Files instead encrypts the files and messages themselves, regardless of how they are transmitted.
Anyone sending a file by email, USB stick, or messenger is not protected by a VPN alone, since the file itself would remain unencrypted.
RotorCrypt X-Files can therefore be used alongside a VPN, but does not replace it: a VPN protects the path, RotorCrypt X-Files protects the content.
Who's it for?
Freelancers and self-employed professionals can store contracts, invoices, and client data encrypted offline, without relying on a cloud provider.
Lawyers and other professionals bound by confidentiality can additionally secure client-related documents before sending or archiving them.
Journalists can protect sources and research material without third parties or service providers gaining insight.
Private individuals can protect personal photos, documents, or financial records from unauthorized access, for example if a device is lost.
For people living in countries without a reliable rule of law, such as dissidents, activists, or members of persecuted groups, encryption can be more than a convenience — it can be vital.
RotorCrypt X-Files transmits no data to a server and requires no account, so there is no central point where messages or files could be inspected or demanded.
This means the individual alone decides who may read a message, rather than authorities, providers, or third parties determining that access.
This right to determine for yourself who may see your own communication is a central idea behind RotorCrypt X-Files.
RotorCrypt X-Files is explicitly not intended for criminal purposes. Use for planning or coordinating crimes, attacks or acts of violence, espionage, or the purchase or sale of drugs or other illegal goods is prohibited. The software is meant to protect lawful private and business communication and data, not to conceal criminal acts.
Guide
For anyone generally interested in data encryption, our guide section offers further comparisons and instructions, for example on alternatives such as VeraCrypt, 7-Zip, or BitLocker, as well as answers to common questions about secure file transfer. To the guide →
Corrupted Key Files
The program manages one encrypted *.key file per contact.
Take precautions: Back up the Key/ folder regularly.
Mobile Use – USB Stick
RotorCrypt X can be operated fully portable.
How to: Copy the program folder to the stick and launch.
Technical Security
A message passes through four mutually independent encryption stages:
① Rotor layer
② AES-256-GCM
③ HMAC signature
④ HKDF key derivation
Registration & Full Version
RotorCrypt X-Files is available as Shareware. The free version allows up to 3 rotors.
Activate licence
Open Help → Registration.
Enter your name.
Enter the licence key.
Frequently Asked Questions
Do I need to install anything to open a file someone sent me?
Only if you want to work with RotorCrypt X-Files permanently yourself.
If you were sent a .exe file, a double-click and the password from the sender is enough. No extra installation is needed.
What happens if I forget my password?
Only logging into the program itself requires a password. That is what makes RotorCrypt X-Files special: neither a text message nor a file sent to a verified contact ever needs its own password — only .exe files do, because they can also be opened by someone who doesn't have the program installed at all.
If you forget your login password, only a reinstall helps, after which all contacts must be set up again. If a recipient of an .exe file forgets the password they were given, that one file can no longer be opened, not even by the manufacturer.
Keep your passwords in a safe place.
Do I need internet for the encryption to work?
No. RotorCrypt X-Files works completely offline. You can use it even on a computer without an internet connection.
Can I use the program even if I'm not good with computers?
Yes. The program is designed so you only need one single password to log in.
The vault then encrypts all files automatically in the background, no extra passwords needed. Sending a file or message to an already verified contact also needs no extra password.
Your login password is never linked to the actual encryption, under any circumstances.
Will the recipient see that I used RotorCrypt X-Files?
Yes, in both cases.
For an RCX file, this is unavoidable, since it can only be exchanged between two contacts who both have RotorCrypt X-Files installed and have reached verified status (green banner).
For an .exe file, it is just as obvious, since the recipient doesn't even need to install the program, but simply opens the file with the password given by the sender.
Does this cost anything?
RotorCrypt X-Files is available as shareware. After the 30-day trial, all features remain fully usable, there is no stripped-down mode.
Only occasionally a reminder window appears offering the full version.
How do I use a file that's stored in the vault?
Just like any normal file. A double-click opens it automatically, and you can edit it as usual.
When closed, it is automatically re-encrypted in the vault, with no extra steps needed.
What happens to a file I sent encrypted — does it stay encrypted forever?
It depends on how the file was sent.
If sent to an already verified contact, decrypting it strictly requires that same contact in the program which received it. The recipient can at any time turn the file back into a completely normal, unencrypted file.
If the recipient deletes that contact, the file becomes permanently undecryptable — even if the same contact is recreated and verified later.
If sent as an .exe file instead, the recipient needs a password, independent of any contact. Decrypting it automatically saves the unencrypted file. The sender can also set an expiry date; if it passes, or too many wrong passwords are entered, the file deletes itself automatically.
A difference from text messages remains: a text message can only be decrypted once, an encrypted file multiple times — as long as the contact wasn't deleted or the file wasn't deleted by expiry or failed attempts.
Can I use RotorCrypt X-Files for private photos or documents, not just business?
Yes, explicitly for that too. Many users use it for example for private photos, ID documents, or financial records.
Can the NSA read my messages?
No — for three reasons that together form a wall that even government agencies cannot breach.
One reason this matters so much: US agencies such as NSA, CIA, or FBI can legally compel virtually any messenger service to hand over the communication between two people — regardless of whether end-to-end encryption is in place. User privacy plays no role for these agencies: the provider holds the keys, or at least access, and must deliver on order.
This is exactly where RotorCrypt X-Files comes in: there is no backdoor, and the encryption algorithm changes with every communication. Even with their most powerful computers, the NSA cannot decrypt a file encrypted this way.
First: There is nothing to request. No server, no cloud, no database. Whoever issues a court order — there simply is no entity that could hand over data.
Second: The mathematics don't allow it. The key space consists of more combinations than there are atoms in the observable universe — and that's not a metaphor. Even a quantum computer that halves the search space via Grover's algorithm faces a computational task that cannot be solved with any physically conceivable means. Moreover: quantum attacks need permanently stored keys in memory as a target — these simply don't exist in RotorCrypt X because they are destroyed immediately after the connection is established.
Third: Even with full device access there is nothing to take. If someone had access to all encrypted files, the device and the entire source code — past messages would still be gone forever. The key IDs needed for decryption were irrecoverably deleted immediately after the connection was established. The mathematical path cannot be reconstructed retroactively.
What happens if my USB stick or external hard drive is stolen?
Nothing — for the attacker. All data that RotorCrypt X-Files stores on external storage media is stored exclusively in encrypted form. Neither direct nor indirect access to the content is possible — without the correct key, any attacker sees only meaningless data garbage with no recognisable pattern.
The password is hardened with a technique that renders even GPU clusters ineffective: millions of attempts per second remain unsuccessful. After the 10th failed attempt, the software automatically deletes all keys according to military standard — the storage medium becomes permanently unusable for the attacker.
How do I exchange the key with my contact?
Prerequisite: Both parties must have RotorCrypt X-Files installed.
Establishing the connection is straightforward: Person A sends an initial message to Person B. As soon as Person B replies, the handshake is complete — both sides know each other and the connection is fully secured from that moment on. No manual key exchange, no USB stick, no additional step.
Is the algorithm transparent?
Fully documented and mathematically verifiable. All security mechanisms are described in the technical documents.
Desktop and mobile together?
RotorCrypt X-Files is currently available exclusively for Windows. A mobile version of this program is not planned at this time.
For encrypted communication between PC and Android, we recommend our separate application RotorCrypt X v1.8.8 (Windows) in combination with RotorCrypt X Mobile — available in the Google Play Store. Both applications use a fully compatible keyfile format and enable seamless, cross-platform encryption.
Shareware vs. full version – what's the difference?
RotorCrypt X-Files is available for free as shareware. After installation, the full feature set is available for 30 days. Even afterward, the program remains fully usable — there is no reduced mode and no locked sections. You will simply be reminded from time to time about the option to purchase the full version.
The key difference lies in the cryptographic strength used for encrypting text messages: while the shareware version is limited to 3 rotors here, the full version allows up to 100 rotors. For comparison: the original Enigma used 3 rotors during World War II — and was broken. RotorCrypt X-Files operates on a fundamentally different security level anyway, thanks to the combination of rotor-based encryption and modern protection mechanisms (AES-256-GCM, HKDF-SHA3-256, ChaCha20). With every additional rotor, the key space grows exponentially — simply unsolvable for an attacker without knowledge of the exact rotor count.
The file vault uses its own, independent encryption method with a comparably high security level and is not affected by this rotor limitation.
What is EAR99 and does it apply to me?
EAR99 is a US export classification for many commercial goods without special cryptography restrictions. RotorCrypt X uses exclusively standardised, publicly available algorithms and may fall under this classification. However, EAR99 is not a global clearance — other countries have their own rules. Users are themselves responsible for compliance with the respective applicable national regulations.
Am I allowed to export the software to my country?
In most countries yes — but not everywhere. Sanctioned or restricted jurisdictions are excluded. The list changes; check official government sources (e.g. OFAC, EU sanctions lists) or contact us at compliance@bagdadi.de before using the software in regions with an unclear legal situation.
What do I do if I'm unsure about the export question?
Contact a specialised lawyer for export control or write to us at compliance@bagdadi.de. When in doubt: refrain from export until clarity is established. Also check whether the recipient is on sanctions or embargo lists (e.g. OFAC, EU lists).
Is RotorCrypt X-Files related to the ransomware virus with a similar name?
No. RotorCrypt X-Files only encrypts what you explicitly choose to encrypt — your own files, folders, or messages.
Only .exe files require a password to decrypt; everything else works automatically through your verified contacts, without ever demanding payment or locking you out of your own data.
RotorCrypt X-Files has nothing to do with the criminal ransomware virus that circulated under a similar name years ago. It is a legitimate, actively developed program made solely for your own security and privacy.
© 2025–2026 Bagdadi Apps