FAQ

What is a .zpkg?

A Zero‑encrypted package: a standard ZIP (store‑only) wrapped in AES‑GCM‑256 with a key derived by PBKDF2‑SHA256(passphrase ⊕ Z‑Pattern v2). The Z‑Pattern is automatic and included in the header as a non‑secret pepper for auditability.

Does it hide filenames?

Yes when Obfuscate filenames is ON (default). Original names + SHA‑256 are kept inside the encrypted header manifest.

Where does processing happen?

Entirely in your browser. Files are never uploaded. You can later upload the finished packages to your own API.

Is this custom crypto?

No. Encryption uses standard AES‑GCM and PBKDF2‑SHA256. Z‑Pattern v2 is an extra pepper layer, not a replacement for vetted primitives.

What if I forget the passphrase?

There is no recovery. Use strong passphrases and keep backups of the encrypted package.