$ open-source · agpl-3.0 · cross-platform
Six-layer cascade encryption, built to survive scrutiny — not avoid it.
Fortress Crypt runs every file through a double cascade of AES-256-GCM, ChaCha20-Poly1305, and Camellia-256, keyed by a triple-chain key derivation (Argon2id + scrypt + HKDF-SHA512, with optional ML-KEM-1024 post-quantum hybrid mode). One interoperable file format. Three native implementations: Python/CLI, iOS, and Android. Fully open source, and openly self-audited in public.
What Fortress Crypt is
Fortress Crypt is a file-encryption system built on a simple premise: don’t invent new cryptography, cascade the best-vetted cryptography that already exists. Every chunk of a file is encrypted twice, through two independent passes of three standardized, peer-reviewed ciphers, so that no single broken algorithm — and no single broken implementation — is enough to expose your data. It ships as a Python library and CLI, a native iOS app, and a native Android app, all reading and writing the same .fortress file format.
Double cipher cascade
Camellia-256-CBC+HMAC → ChaCha20-Poly1305 → AES-256-GCM, run twice with independent key sets. All 6 authentication tags per chunk must verify or decryption halts.
Triple-chain key derivation
Password → Argon2id → scrypt → HKDF-SHA512 → master key → 11 sub-keys. Two independent memory-hard functions are XOR-combined, so a weakness in either alone doesn’t compromise the master key. Optional ML-KEM-1024 post-quantum hybrid mode.
One format, three platforms
A file encrypted on Python, iOS, or Android decrypts on all three. No format lock-in, no platform lock-in — the reference implementation and specification are both open.
Why it exists
Single-algorithm encryption puts all your trust in one cipher, one key, one implementation. Cascade encryption — the same principle behind tools like VeraCrypt — spreads that trust across independent, standardized primitives, so a future break in any one algorithm doesn’t automatically break your data. Fortress Crypt applies that idea to a modern, cross-platform, post-quantum-ready file format, and treats the whole design as an open engineering study rather than a black box.
Disclaimer: Fortress Crypt has not yet undergone a formal third-party cryptographic audit. For protecting real high-value data against sophisticated adversaries today, use established, audited tools (VeraCrypt, age, LUKS) alongside or instead of Fortress Crypt. This project is a serious engineering effort and a defense-in-depth design study — and it’s why community security review is the single most valuable form of help right now.
We audit ourselves in public
Rather than wait for a paid third-party audit to talk about security, Fortress Crypt runs its own adversarial review and publishes every finding — critical, high, medium, or low — with root cause, fix, and commit hash. Six findings from the most recent independent pass are documented and fixed or explicitly mitigated with the residual risk stated plainly.
6
Findings published from the latest independent audit pass, including two critical issues
100%
Of findings documented publicly with root cause, fix, and commit reference
0
Findings hidden, downplayed, or silently patched without disclosure
Open source today, sustainable tomorrow
Fortress Crypt is licensed AGPL-3.0 to everyone, today. Anyone can use, study, modify, and redistribute it, provided derivatives and network deployments stay open — the same copyleft principle used by projects like MongoDB and Qt. The maintainer is not currently selling commercial licenses; a commercial licensing option for organizations that need to embed Fortress Crypt without copyleft obligations is planned for later, once the project and its audit trail have matured. Nothing about today’s open-source access changes when that happens.
Help build the fortress
The source is public at code.fortresscrypt.com. The project needs cryptographers and security researchers to pressure-test the design, engineers to port and harden the Python/iOS/Android implementations, and technical writers and translators to make the project legible to more people. See what’s needed and how contributions and licensing work.