Description: "ATLOCK v5 by Akhouri Systems: Argon2id + AES-256-GCM encryption, a decoy vault, FIDO2, ransomware canaries, Shamir recovery, and a self-verifying release. Here's how it works."

ATLOCK v5 is out. 🔐

Some people say "Akhouri Systems has never built a serious app."

From today, I have a one-word reply:

ATLOCK_v5

Hey dev.to 👋 I'm Anmol, founder of Akhouri Systems. I'm 13.

I'm not telling you my age for sympathy points. I'm telling you because I want you to judge the app, not the birth certificate. So here it is:

👉 Download ATLOCK v5

What is ATLOCK?

ATLOCK is a Windows-first total security suite, shipped as a .exe and written in pure Python.

The app runs exactly as you'd expect with no arguments, and the CLI is there if you want to go deep.

The architecture, in one picture

        ┌────────────── ATLOCK v5 ──────────────┐
        │   Tkinter UI  ·  CLI (--flags)        │
        ├───────────────────────────────────────┤
        │ File Guard │ Vault │ Quick Lock       │
        │ Defender   │ Canary│ Watchdog         │
        ├───────────────────────────────────────┤
        │  2FA: TOTP · FIDO2 · Windows Hello    │
        ├───────────────────────────────────────┤
        │  Sealed State (AES-GCM + HMAC anchors)│
        ├───────────────────────────────────────┤
        │  Crypto core: Argon2id → HKDF →       │
        │  chunked AES-256-GCM (v3.1 container) │
        └───────────────────────────────────────┘

🔬 The nerdy part (my favorite)

1. Container format v3.1: built like a real crypto format

Every locked file, folder, and Quick Lock item uses my own container format:

• Chunked AES-256-GCM: each chunk is authenticated independently, so one corrupted chunk doesn't mean a lost file
• Key commitment: a wrong password is detected before any plaintext is produced
• Per-seal chunk subkeys derived with HKDF
• Header-bound AAD: tamper with the header and decryption fails
• Padme padding (optional): hides the true file size, with at most ~12% overhead
• Backward compatible: v1/v2 containers and old 5.0 files still open and migrate automatically

2. Argon2id everywhere (and a safety ceiling)

Passwords are stretched with Argon2id, at a 64 MB / t=3 floor for files and 128 MB / t=4 for the vault and recovery keys.

The part I'm proud of: untrusted headers can't abuse the KDF. If someone hands you a doctored file claiming "use 40 GB of RAM," ATLOCK refuses. There's a hard ceiling (512 MB, t=6, p=8), so a malicious file can't freeze your PC.

3. The panic password (decoy vault) 🎭

The vault has two passwords:

• your real master password
• a panic password that opens a believable, entirely fake vault

Here's the clever bit: both slots are derived concurrently with the same KDF cost, so an observer can't tell which password you typed by timing it. And the decoy slot always exists, filled with random bytes if you never set one, so the file itself never reveals whether you use panic mode.

4. Real second factors

• TOTP (RFC 6238), implemented in pure Python 🐍
• FIDO2 / WebAuthn hardware keys (YubiKey etc.)
• Windows Hello (face / fingerprint / PIN)
• Fail-closed policy: if your policy requires a second factor and it isn't set up, access is denied, not skipped

5. Anti-rollback sealed state

Settings, vault data, lockout counters, watchdog and canary databases all live in sealed state: AES-256-GCM encrypted, HMAC-authenticated, protected by a Windows DPAPI-wrapped key, and rollback-anchored. If an attacker restores an old copy to reset your wrong-password counter, ATLOCK notices and hard-locks.

6. Breach checks without leaking your password

The vault audits for weak, reused, old, and breached passwords. The breach check uses HIBP k-anonymity: only a 5-character hash prefix ever leaves your machine, never the password.

7. Clipboard that doesn't snitch

Copied passwords are flagged so Windows excludes them from clipboard history and cloud clipboard sync, then cleared automatically.

8. Hardened against nasty files

• Folder locking uses a hardened ZIP pipeline that defends against zip-slip, path traversal, symlink tricks, and zip bombs
• DLL-planting defence runs before any other import loads a DLL
• All data is ACL-restricted to your Windows user
• SecureBuffer + VirtualLock + zeroing for secrets in memory, best-effort (see the honesty section)

9. Recovery done right

• Shamir secret sharing: split a recovery key into shares and rebuild it from enough of them (--shamir-split / --shamir-join)
• One-time recovery codes
• Forgot the master password? --reset queues a reset that completes after 24 hours, and any successful unlock cancels it, so an attacker can't instantly take over

10. In v5: stuff I'm really proud of

--getting-started        # plain-language quick start + glossary
--device-health          # BitLocker / hibernation / cloud-folder check
--keyfile-create PATH    # strong keyfile for File Guard
--wipe-free-space        # overwrite free disk space
--fuzz 300               # stress-test the container parser with 300 random corruptions
--pk-keygen / --pk-encrypt / --pk-decrypt / --sign / --check-sig   # public-key crypto
--verify-self            # signed-release self check
--import-passwords FILE  # Bitwarden / Chrome / Firefox / KeePass / 1Password

Yes, ATLOCK ships with its own fuzzer and a self-test (--selftest). I wanted it to attack itself before anyone else does.

Extra lock: in File Guard you can require both your password and a keyfile or hardware key, so a stolen password alone isn't enough.

🧠 Honest limits (the part most projects skip)

Real security engineers respect honesty more than hype, so here's what ATLOCK cannot do. This is also written into the source code:

• A same-user attacker who can run code as you can modify the program or its files, or read process memory. Integrity checks and anti-debug raise the cost, but they don't make it impossible.
• Python strings are immutable, so passwords can't be guaranteed erased from RAM.
• Secure shredding on SSDs isn't guaranteed. BitLocker is the real fix, and --device-health checks for it.
• No kernel driver and no code signing. ATLOCK is an application-layer tool, so Windows SmartScreen may show a warning the first time you run it. Check the SHA-256 below before you run it.
• FIDO2 here proves the registered key was present and touched. It doesn't validate the vendor.
• The real defence against offline guessing is Argon2id + a genuinely strong password.

I'd rather you trust ATLOCK for what it is than be fooled by what it isn't.

🚀 Get started

1. Download and extract ATLOCK_v5.zip
2. Run ATLOCK_v5.exe. New here? Try ATLOCK_v5.exe --getting-started first.(when you run ATLOCK_v5 first time it will automatically show the guide)

⭐ Repo: github.com/Akhouri-Anmol-Kumar/ATLOCK

Why I built this

I didn't want to build another to-do app to prove I could code. I wanted to build something where every design decision has a reason, a tool I'd trust with my own files, and one I could defend line by line.

Hype lasts a week, but work that holds up lasts years. That's why ATLOCK has versioned formats, automatic migrations, a self-test, a fuzzer, and a page of honest limitations.

Akhouri Systems is just getting started. ATLOCK v5 is proof of what we can build, and it's the floor of what's coming, not the ceiling.

💬 Your turn, dev.to

• Break it. Run ATLOCK_v5.exe --fuzz, read the container format, try to find a flaw.
• Open an issue or PR. I read every one.
• Tell me what v6 should have. No promises on timing, though. I'm pretty exhausted after this one 😅

I'm 13, I'm just getting started, and this is v5. 😉

— Anmol Kumar Akhouri
Founder, Akhouri Systems

Built with Python, tkinter, cryptography, and argon2-cffi.