‹ YuzoolGuideOpen app

Lockbox guide

Self-opening encrypted file

A self-opening file is an encrypted box with its own unlocker built in, as a single .html file. The person who gets it opens it in any web browser, types the password and saves the files, with no website and no internet. Lockbox makes one free: choose No website needed before you lock.

Updated · 4 min read

How it works

The file holds two things: the locked data, written as text, and a small, readable unlocker. When it’s opened, the unlocker asks for the password and unlocks the data right there in the browser.

The page carries its own security rule (a Content Security Policy) that blocks every request to the internet, so it can’t load anything or send the password anywhere. You can open it with the Wi-Fi off and it still works. It holds the data as text, so it’s about a third bigger than a .lockbox file, and Lockbox offers it up to 200 MB.

Make one

  1. Open Lockbox and add the files.
  2. Set a password, or tap Make one for me.
  3. Under What to send, choose No website needed.
  4. Tap Lock and Save. Send the file one way and the password another.

Two catches

  • iPhone and iPad: the preview in Mail or Files shows the page but doesn’t run its unlocker. Tap Share, then Open in Safari, or open it from Files in Safari. Or use yuzool.com/lockbox, which opens the self-opening file too.
  • Workplace email: some email systems block .html attachments, because fake sign-in pages travel that way. Zip the file first, or send the .lockbox file instead.
Watch for look-alikesA real Lockbox file only ever asks for the box’s password, and never for an email or account password. It can’t connect to the internet. If a file that says it’s Lockbox asks you to sign in to anything, don’t type a thing.

An open format

Lockbox’s format, LOCKBOX1, is written up in full so anyone could make their own unlocker: AES-256-GCM in 1 MB pieces, each bound to its place and the last one marked, with the key from PBKDF2-SHA-256 at 600,000 rounds. The self-opening file’s unlocker is plain, readable code inside the file itself.

Questions

Does the person need the internet?

No. The self-opening file unlocks with no connection at all.

Does it work on Windows and Android?

Yes: in any modern browser, such as Chrome, Edge, Firefox or Safari, on Windows, Mac, Android and (in Safari) iPhone.

Is it safe to open?

A self-opening file made by Lockbox can’t load or send anything, as its own security rule blocks it. Only type the password the sender gave you for that file.

How big can it be?

Up to 200 MB of files. Bigger boxes go as a .lockbox file.

Sources