‹ YuzoolGuideOpen app

Lockbox guide

How to password protect a file

To password protect any file, lock it with encryption so it can only be opened with the password. Lockbox does this in your browser for free: pick the file, set a password, and save the locked copy. The file never leaves your device.

Updated · 5 min read

Three ways to do it

  • In the app that made it. Microsoft Word, Excel and PowerPoint can encrypt a document: File › Info › Protect Document (or Workbook) › Encrypt with Password. Good when the other person has the same app.
  • An encrypted archive. Tools such as 7-Zip can make a .7z or .zip locked with AES-256. Several files go in together, but the other person needs a tool that opens that kind of archive, and not every computer’s built-in unzipper can open an AES-locked zip.
  • Lockbox, in the browser. Any file, or several at once, locked into one box with AES-256. The other person opens it on yuzool.com/lockbox on any phone or computer, or you send a self-opening file that needs no website at all.

Lock a file with Lockbox

  1. Open Lockbox. There’s nothing to install and no account.
  2. Drop the file on the page, or tap Choose files. Add more if you like: they all go into one box.
  3. Type a password twice, or tap Make one for me for five random words.
  4. Choose what to send: a .lockbox file (small, opens on yuzool.com/lockbox) or a file that needs no website.
  5. Tap Lock, then Save. Your original file is untouched; the locked copy is the one to send.
There’s no resetLockbox doesn’t keep your password anywhere. If it’s lost, nobody can open the box: not Yuzool, and not you.

A password that holds

Anyone who has the locked file can try passwords on their own computer for as long as they like, so the password is the whole of the protection. Lockbox slows each guess down (it runs the password through 600,000 rounds of PBKDF2 before it becomes a key, the figure OWASP recommends), but a short or common password still falls quickly.

Length beats cleverness. Five random words, such as otter-banjo-crisp-lantern-quiet, are easier to type than P@ssw0rd! and far harder to guess. That’s what Make one for me gives you, drawn from the EFF’s list of 7,776 words. The strength meter warns you when a password is weak, and you can check any password with the Password Generator.

What a password protects, and what it doesn’t

  • Protected: the contents, and in Lockbox the file names, types and sizes too. Without the password the box is noise.
  • Protected: changes. If anyone alters even one byte of the box, it refuses to open rather than giving back a damaged file.
  • Not protected: a password sent in the same email as the file. Send them by different routes (see sending a file securely).
  • Not protected: the file once it’s unlocked. Whoever opens it can save and share it like any other file.

Questions

Is Lockbox really free?

Yes. Locking and unlocking files up to 100 MB a box, the self-opening file and notes in a link are free. Lockbox Pro ($1.99, once) adds bigger boxes, folders kept as folders and a password hint.

Is my file uploaded?

No. Lockbox locks and unlocks files on your device with your browser’s own encryption. Yuzool never sees the file or the password.

Can Yuzool recover my password?

No. The password isn’t stored anywhere, so a lost password means the box can’t be opened.

What encryption does Lockbox use?

AES-256-GCM, with the key made from your password by PBKDF2-SHA-256 at 600,000 rounds and a random salt for every box. The format is published so anyone can check it.

Sources