Steganographic storage
A drive that sounds like music.
Povoloka keeps an encrypted filesystem in the low bits of ordinary media. The carrier still plays in any player and still opens in any editor — it is a working FLAC, a working WAV, a working text file. The files inside it are simply not something the file appears to have.
Free and open source · MIT OR Apache-2.0 · Windows, macOS, Linux, Android
One control, one honest trade-off.
Density is how many of the sixteen bits in each audio sample Povoloka is allowed to use. At k = 1 it writes to the last bit only: an error of one part in 32768, some ninety decibels under the music, which no ear and no speaker will ever resolve. Raise it and every sample carries more — and every sample is rounded to a coarser step, until at k = 8 the audio has 256 amplitude levels instead of 65536 and a quiet passage picks up a hiss. That ceiling is in the code, not in the marketing: audio stops at eight of sixteen bits, text at three.
Four carriers. All read, all write.
A drive is not a second file sitting next to your music — it is inside it. Every format below can be generated from nothing, or written into a file you already have. Images and PDF come next; audio and text ship first because they change the carrier least.
One file. Two passwords. Two different drives.
Alongside the real partition a carrier can hold a decoy, opened by a second password. Give that one up and the drive opens, mounts, and shows plausible content — with no indication that anything else is there. Try both:
- passports.pdf2.4 MB
- wallet-recovery.txt184 B
- contracts/7 items
- notes.md12 KB
- tax-2024.pdf880 KB
- receipts/3 items
- todo.txt96 B
The decoy is not a trick of the interface. Opened with the decoy password the drive reports that it has no decoy at all, because from inside that partition there is nothing to report.
Keep it on your disk, or keep it in sync.
Both work the same way, because the drive is the file. Nothing about it changes when it travels.
On your machine
Open a carrier from anywhere — a folder, a USB stick, a shared drive. Mount it over WebDAV and it behaves like any other volume in your file manager.
Synced through your account
Keep the carrier on povoloka.com and reach it from a desktop, a phone or the browser. Edit on one device and the others are told to re-fetch, so two sessions never drift apart.
You decide what the server is allowed to know
A drive can derive its key from your account password, so it opens the moment you sign in — convenient across devices, and the server can help. Or it can carry its own password, which is never sent anywhere: the server then holds a file it cannot read, and you type the password on each device yourself.
That is a setting per drive, not per account, and you can keep both kinds side by side.
Mounted like any other drive.
A drive does not have to be browsed through an application. The desktop app runs a WebDAV server on your own machine and asks the system to mount it, then opens your file manager at it.
From there every program sees an ordinary volume. Open a document straight from it, edit, save — the editor neither knows nor needs to know that the folder it is writing to lives inside a FLAC file.
Nothing is unpacked to disk on the way. The drive is decrypted in memory only, and three seconds after the last write the carrier is re-encoded and saved back. Unmount it and what remains on your disk is the file you started with, the same size, still playable.
This is the one thing the browser client cannot do — it has no way to offer the system a volume. For mounting you need the desktop application.
Everywhere you keep files.
The same core — the same drive format, the same encryption — compiled for each platform. A drive made on one opens on all the others.
Or don’t install anything.
The same core, compiled to WebAssembly and running inside the page. Not a preview or a viewer — it creates drives, sets the density, makes decoy partitions and edits files, exactly like the desktop application, because it is the same code.
Pick a carrier off your disk or open one from your account. Either way the password is typed into the page and the decryption happens there: nothing about the key is sent anywhere.
What this protects against, and what it does not
Povoloka is concealment on top of encryption, not instead of it. The contents are encrypted with AES-256 and a key derived with Argon2, so a carrier you lose is a file nobody can read. Concealment is the second layer: someone looking at your disk sees a music library rather than an encrypted volume, and has no obvious thing to demand a password for.
It is not a claim of invisibility against a determined analyst with the original file to compare against. Statistical analysis of low bits is a real field, and it is older for audio than for anything else. Use this for what it is good at — not drawing attention — and pick your density accordingly.
More on the guarantees and the interface: features, WebDAV access, screenshots.