Security
How Doughnut Forge keeps your files private, and how to report a security problem.
On your device only
Doughnut Forge encrypts and opens your files on your own device. Your files are never uploaded.
No servers, no account
There are no Doughnut Forge servers and no account to create, so none of your files or details are stored anywhere else.
Post-quantum encryption
Doughnut Forge uses post-quantum encryption, which is designed to resist the powerful quantum computers of the future, so what you protect today stays protected.
Your keys stay with you
Your password and keys stay on your device. They are never stored on a server or sent across the network.
Not audited yet
Doughnut Forge has not had an independent security audit yet. One is planned. See the roadmap
Report a vulnerability
If you find a security problem in Doughnut Forge or this website, report it privately on GitHub. Please do not open a public issue.
Only the developer can see your report. You need a free GitHub account.
Every report gets a reply. Doughnut Forge will not take legal action against anyone who looks for and reports a problem in good faith: without harming anyone or reading other people's data, and allowing time for a fix before sharing details.