Voxta Encryption
At-rest encryption of your chats, characters and images — what it covers and what it doesn't.
Voxta can seal your content under a key the server cannot derive on its own while locked. Chats, character sheets, memory books and uploaded images all go under it.
Turn it on from Profile menu → Encryption, or during registration.
What it protects
Someone else getting the files. A stolen laptop, a synced backup, a support bundle, a hosting provider. Without the key, the Data folder is inert.
One account reading another's. Isolation used to rest on every database query remembering to filter by user. Now a query that reaches the wrong row fails an authentication check instead of returning readable content — a silent leak becomes a loud error.
What it does not protect
This is not end-to-end encryption. A running, unlocked server holds your content in memory and sends it to whatever LLM and TTS providers you configured. The threat model is someone getting at your storage, not someone with your machine already running and unlocked.
Unlocking is per session, not per action — nothing asks again before opening a chat, and it shouldn't.
Some things stay readable by design: how many chats and messages exist, when they happened, roughly how long each one is, and the folder layout. Internal ids, your username and password hash, and a few lookup columns are plaintext because they are read before any key is open.
Device mode or Password mode
Your key is wrapped, and how it is wrapped is the choice you are making:
| Mode | Opened by | Good for |
|---|---|---|
| Device | The device.key file on this machine | No password prompt. The machine unlocks it. |
| Password | Your account password, with a recovery code as the fallback | Content that stays yours on any machine. |
Device mode does not travel. On Windows device.key is bound to the machine that made it, so a backup restored elsewhere cannot be opened at all. Switch to Password mode before moving — it rewraps the key without re-encrypting anything, so it is quick. See Back up your data.
The recovery code
You are shown a recovery code once, when you enrol or rotate the key. It is the only way back into Password mode content if you forget the password.
Nothing is encrypted until you confirm you kept it. Enrolling mints the key and shows the code while storing nothing; closing the tab at that point leaves you exactly as you were. There is no timer, because writing a code down is precisely the sort of thing that gets interrupted.
Keep it somewhere that is not the machine Voxta runs on.
Turning it on
Set an account password
Password mode wraps your key under it. Registration asks for both on the same step for this reason.
Enrol
Profile menu → Encryption. Pick the mode, then keep the recovery code and confirm you kept it.
Let it convert
Voxta walks your existing content and re-writes it sealed. You can keep using Voxta while it runs.
Rotating, and turning it off
Changing the key, changing the mode and turning encryption off are the same operation with a different destination, and all of them behave the same way:
- Resumable. Every row is valid at every instant, so an interrupted conversion is not a broken library. A crash costs you a batch.
- Verified by looking. Completion is confirmed by reading what is actually stored, not by trusting a counter — because a counter that is right for the wrong reason becomes unreadable content the moment a key is dropped.
- Old keys expire rather than vanish. A retired key is kept for 90 days and re-checked before it goes, in case something still refers to it.
Changing your password does not re-encrypt anything: it rewraps about 32 bytes.
Exports are not encrypted
Chat exports, character cards and packages are written in the clear, or under a passphrase you give — never under your encryption key. That is what makes them restorable anywhere, and it is worth remembering when you hand one to someone.