Secure file transformation system.
/encode <file/folder> <password>
encode any file or folder to .rpn format
/encode <./directory/> <password> --all
encode all files and subfolders present inside a directory
/decode <file.rpn> <password>
decode any .rpn file back to its original constituents
/decode <./directory/> <password> --all
decode all .rpn files back to its original constituents present inside a directory
/origin <file.rpn>
inspect file metadata to trace its origin (administrative use only)
/fingerprint <file.rpn>
inspect the fingerprint of a .rpn file
Your password is never stored. It's passed through Argon2id key derivation with a unique 16-byte salt per file. This makes brute-force and rainbow table attacks computationally infeasible. The derived key is then used for AES-256 encryption.
The encoder will refuse to perform any operation. This is intentional — it ensures that only authorized instances with proper validation can use the software. Local caching of auth tokens is not supported for security reasons.
No. The .rpn format uses authenticated encryption with parameters that require the exact decoding routine. Even with the correct password, decryption requires the official decoder binary with valid integrity hash and remote authorization.
Only operational events: timestamps of encode/decode attempts, success/failure status, and file size (not content). No filenames, passwords, or file contents are ever transmitted. The logging exists for monitoring unauthorized access attempts.
Each encoded file contains a deterministic fingerprint generated from the encrypted data. This allows the system to verify the file’s identity and detect any form of external tampering without needing to decrypt the content or expose sensitive metadata.
On each startup, the executable calculates its own SHA-256 hash and compares it against a trusted hash retrieved from a remote verification endpoint. If they don't match — indicating modification or tampering — the program immediately halts execution.
Yes, but only through a restricted process. The system includes a specific /origin command that allows for the inspection of origin information. However, this action requires a dedicated authorization code to ensure that metadata cannot be casually extracted by unauthorized users.
This is a core part of the system's "controlled access" philosophy. By verifying authorization remotely before performing sensitive operations like encoding or decoding, the system prevents unauthorized use of the software even if the binary itself is copied or moved to a different machine.