How to test local message encryption with VVault

Local encryption means the encryption operation happens on your device. It does not mean that the device, browser or code is automatically trustworthy. This guide checks one small VVault workflow using fictional data. It does not establish that the beta is suitable for sensitive information.

Start with a harmless message

Open VVault in a browser you control. Record the app version, device, operating system and browser. Use a fictional sentence such as “Blue bicycle, test number 42.” Keep a separate note of the expected text so you can compare every character later. Do not use a real password, address or private conversation.

Encrypt and save the package

1. Choose Encrypt a message and enter your fictional text.
2. Enter and confirm a fresh test passphrase of at least 14 characters. Do not reuse an account password.
3. Select Encrypt on this device, then Save encrypted file. Check that the download exists before leaving the tab. The default filename is v-vault-message.vvault.

VVault clears its session when the tab is hidden or after two minutes without input. Keep the test passphrase separately from the encrypted package. A saved file and a package still visible on screen are different things; this test must continue from the actual download.

Reopen the actual saved file

The current VVault interface accepts package text. Its companion VRelay provides the file picker. Use that existing flow to recover the package from the file:

1. Open VRelay and select Load a .vvault file (optional). Choose the actual file you just downloaded.
2. Select Check package format, then Copy package. A successful check means the envelope has the expected structure; it does not authenticate a sender or verify the plaintext.
3. Return to VVault. First choose Unlock an encrypted package, then paste the package copied from the file. Changing mode clears the previous input.
4. Enter the original test passphrase and select Unlock on this device.
5. Compare every character with your original sample, including spaces, punctuation and line breaks.

If the file cannot be saved, selected or loaded, report the exact step as failed or blocked. Do not paste the original on-screen output and count that as a successful file-reopening test. Copying ciphertext uses the system clipboard; clearing a tool’s session does not clear clipboard history.

Check the wrong-passphrase response

Select Clear session to remove the previously unlocked result. Load and copy the same saved file through VRelay again if needed. In VVault’s unlock mode, paste the file-derived package and enter a different test passphrase. The attempt should fail without revealing the note. Record the actual result; a failure message alone is not evidence of a security audit.

Report what happened

Use VVault test feedback. State PASS, FAIL or BLOCKED, the numbered step, expected and actual result, app version, device/OS/browser, and whether you reopened the actual saved file. Keep the confirmation reference. Leave out the note, passphrase, encrypted package and personal details. Reports go privately to the project owner; do not assume anonymity.

What this test cannot prove

A successful round trip does not establish resistance to all attacks. VVault does not authenticate a sender, offer passphrase recovery or provide forward secrecy. Someone who later obtains the passphrase and an old package may be able to decrypt it. Malware, browser extensions, keyboards, screenshots and an unlocked device are outside the protection of message encryption.

Before trying offline use

Use Enable offline use while connected, then follow the app’s instructions, disconnect and reload to check that it opens. Do not assume a page is available offline just because it was previously visited. Inspect the source and current release notes; independent review remains outstanding. Return to Start testing for the other focused tasks.