decrypt-vault

decrypt-vault is a command-line tool for decrypting vault archive files on a local machine.

Install

npm i -g decrypt-vault

Confirm the command is available:

decrypt-vault version

Supported Platforms

• macOS x64
• macOS arm64
• Windows x64

Decrypt a Vault Archive

decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain

--input is the encrypted archive path.

--output is the directory where decrypted files will be written.

Decrypt a Single Cipher File

If you already know the encrypted file to decrypt and do not need to recover the original directory structure or filename, decrypt one file directly:

decrypt-vault decrypt-file \
  --config ./gocryptfs.conf \
  --input ./cipher-file \
  --output ./plain-file

Required options:

• --config: path to the vault's gocryptfs.conf
• --input: path to one encrypted gocryptfs file
• --output: output file path for decrypted content

This mode does not read gocryptfs.diriv and does not decrypt the original filename. The output filename is whatever you pass with --output.

Password Options

Use the default password behavior:

decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain

Pass a password directly:

decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain --password 'your-password'

Read a password from a file:

decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain --password-file ./password.txt

Read a password from stdin:

printf '%s\n' 'your-password' | decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain --password-stdin

Use only one of --password, --password-file, or --password-stdin in a single command.

Replace Existing Output

The output directory must be empty by default. To replace an existing output directory, add --force:

decrypt-vault decrypt --input vault.enc.zip --output ./vault-plain --force

For decrypt-file, --force replaces the output file if it already exists:

decrypt-vault decrypt-file \
  --config ./gocryptfs.conf \
  --input ./cipher-file \
  --output ./plain-file \
  --force

Troubleshooting

Unsupported platform:

decrypt-vault: unsupported platform <platform>-<arch>

Use macOS x64, macOS arm64, or Windows x64.

Output directory is not empty:

output directory "./vault-plain" is not empty; use --force to replace it

Use an empty output directory or rerun with --force.

Output file already exists:

output file "./plain-file" already exists; use --force to replace it

Choose a new output file or rerun decrypt-file with --force.

Password or archive error:

error: ...

Check that the archive path is correct and retry with the expected password.