vault

Setup generates a keypair and splits it: the public half sits in the open, and the secret half is wrapped in a passphrase. That split buys one genuinely useful property — putting a document in never asks for the passphrase, only reading one does. A stack of statements can be scanned into the store by a script, on a schedule, with no secret available to that script at all.

Metadata is treated as being exactly as sensitive as the documents, because a list of your medical appointments is a medical record. Titles, tags and notes are encrypted too, written one record per event to an append-only journal, so adding never has to decrypt anything and a corrupted record costs at most one entry.

The store is nothing but ciphertext, so it is safe to carry on a USB stick. Plaintext is only ever written to a memory-backed filesystem — but on a machine with disk-backed swap that is not the same as a promise, and the documentation says so in those words rather than leaving the reader to assume the stronger claim.

The threat actually worth designing against is someone copying the whole store and guessing offline, at their own pace, forever. A minimum passphrase strength helps a little. An optional keyfile — something you have, kept separate from the store — removes that game entirely.