About the Project Takes one or more files/folders and converts them into a single self-extracting Windows command script (*_decrypt.cmd). Running it on Windows 7, 8.1, 10, 11 or Server asks for the password / key file (if used) and safely restores the content. No external software required. No third-party software needed: AES-256 encryption, PBKDF2, HMAC and GZip are done entirely with Windows' built-in components: cmd, Windows PowerShell and the .NET Framework's own System.Security.Cryptography / System.IO.Compression classes (the helper code is compiled at run time by the C# compiler that ships with Windows). You do not have to install or download anything such as 7-Zip, OpenSSL or GPG, and no internet connection is used; the cipher itself is not hand-written either, it is Windows' standard cryptography library. ✨ Features Encryption & security Built-in Windows encryption: AES-256, PBKDF2 and HMAC-SHA256 come from the .NET Framework cryptography classes; there is no third-party tool or library. AES-256-CBC + HMAC-SHA256 (encrypt-then-MAC): a modified or corrupted file is rejected before anything is written. PBKDF2-HMAC-SHA256, 600,000 iterations (the count is stored in the file). Random 16-byte salt and IV. Password confirmation (asked twice) and a strength meter, with a warning for weak passwords. Key file support: use any file as a key instead of, or together with, a password (two-factor). At the key file prompt you can type the path, drag the file into the window, or type ? to pick it in a "Select file" dialog (useful in elevated windows where drag and drop does not work and on Server operating systems; on Server Core, where the dialog cannot open, type the path). This feature has been tested and works. The password never appears on a command line; it is read as a SecureString and intermediate buffers are zeroed after use. Passwords with special characters (& ! % " ') work. The original SHA256 is stored inside the encrypted data (it is no longer written in clear text in _decrypt.cmd). 3 attempts in the decoder; a wrong password is detected immediately without decrypting the whole file. Safe extraction: archive paths are validated (no .. escapes out of the target folder). Script Integrity Protection: SecureEncrypt.cmd verifies its own SHA256 signature before running (it detects accidental/simple changes; it does not protect against an attacker). System Directory Protection: C:\Windows, C:\Program Files, $Recycle.Bin, System Volume Information, etc. cannot be encrypted. Only your user profile and non-system drives are allowed. Convenience Multiple files/folders: drag several at once or multi-select with right-click; they are bundled into one _decrypt.cmd. Right-click menu: one Encrypt entry for files, folders and mixed selections, and Decrypt for *_decrypt.cmd files. With a multi-selection Explorer starts one process per item; a small helper (C:\Windows\SecureEncrypt.js, opens no window) asks Explorer for the whole selection of that window and handles everything in one window (no timing involved, no delay for a single file). If the selection cannot be read (e.g. on the desktop) a queue method is used: late instances are added to the main window while you type the password ("Added N more selected item(s)"), anything even later gets its own window, so no item is ever lost. If Windows Script Host is disabled, the built-in queue method is used instead. No folder questions: when encrypting, the _decrypt.cmd is written next to the source; when decrypting, the content is extracted next to the _decrypt.cmd file. Delete-originals option: the output is first verified by decrypting and comparing, then deleted after your confirmation; optionally overwritten first (no guarantee on SSDs). Conflict handling: overwrite all / rename / skip all / cancel. Timestamps and attributes are preserved; empty folders can be encrypted too. Automatic GZip compression (except for already-compressed types). One script, two languages: Turkish when Windows is Turkish, English otherwise. Force with set SE_LANG=tr or en. Unicode support: file and folder names and the password can be in any language (Chinese, Japanese, Korean, Arabic, Cyrillic, Turkish, etc.); names and password are handled as Unicode and come back unchanged when decrypting. The script file is pure ASCII, so the system language / code page of Windows does not matter. It also works when the user name or %TEMP% path contains characters outside the system code page (the compile step is moved to an ASCII folder temporarily if needed). Note: the console font may show some characters as ? or boxes; that is display only and does not affect the operation. Keep the keyboard layout on Latin when answering prompts (e/h, y/n). This was tested with different code pages (chcp) and Unicode names; it has not been tested on a real Chinese/Japanese/Korean/Arabic Windows installation. Streaming: very large files are handled without memory errors, with a progress bar. Self-extracting: data and logic live in one .cmd (created read-only). No ZIP/Shell.Application needed for folders; an own container format is used, so Windows 7 behaves exactly like Windows 11. No-password mode: if you enter neither a password nor a key file, the data is not encrypted; it is only compressed and XOR-obfuscated (not readable as plain text, but not security). How to Use? Installation (optional) Download SecureEncrypt.cmd and double-click it; accept the UAC prompt. Answer Y to the install question. Encrypt (files and folders) and Decrypt (for *_decrypt.cmd) are added to the right-click menu. Run the script again to update or uninstall (1 = update, 2 = uninstall). Encrypting Right-click (needs installation) or drag & drop one or more files/folders onto SecureEncrypt.cmd (no installation needed). The default flow is short: Password (ENTER = skip) → Confirm password → Advanced options? [y/N]. Press ENTER and encryption starts right away, the output is written next to the source and the originals are kept. Answer Y to also be asked for Key file and Originals (N / D / S). With D or S the originals are deleted without a further prompt once the output has been verified. Output: Name_decrypt.cmd (Name_and_N_more_decrypt.cmd for several items). Decrypting Double-click the ..._decrypt.cmd file (or right-click → Decrypt). You are asked for the password and/or key file if needed; the content is extracted into the folder the file is in. A SHA256 check is shown at the end. Security Model: Can My Password Be Broken? Security depends on the strength of your password (and/or key file). The algorithm (AES-256): unbreakable. An attacker tries to guess your password, not to break AES. PBKDF2 (600,000 iterations) slows down every guess, but cannot save a weak password. Password Strength Example Security Status Very Weak 1, 123, password123 INSECURE Strong My!Pass-1990 SECURE Paranoid red-car-77-fast-goes? or password + key file VERY STRONG Limits (please read): In no-password mode nothing is encrypted. "Script Integrity Protection" only catches accidental or naive changes; someone who can edit the script can edit the check too. File names and sizes are kept inside the encrypted data, but the total size of the archive is visible. Deleting (even overwriting) cannot promise to leave no remnants on SSDs or cloud-synced folders. If you forget the password there is no way to recover the data. ⚙️ Dependencies Windows 7 SP1, 8.1, 10, 11 or Server Windows PowerShell 2.0 or later (built in from Windows 7) and .NET Framework 2.0+ (built in on Windows 7; .NET 4.5 is not required) The helper code is compiled with Add-Type on first use (takes a second or two). Note: the helper code is written in C# 2.0 against .NET 2.0 APIs and was verified to compile under that restriction. It was tested end-to-end on Windows 7 (PowerShell 2.0) and Windows 10/11 (PowerShell 5.1) and works without problems. Technical Details File format (*_decrypt.cmd) [batch launcher][#PS_BEGIN … PowerShell + C# decoder … #PS_END][binary payload] Binary payload (SEv2): Mode 2 (AES): "SEv2" | 2 | flags | iterations(4) | salt(16) | IV(16) | key-check(16) | AES-CBC(SHA256(32) + [GZip](container)) | HMAC-SHA256(32) Mode 1 (no password): "SEv2" | 1 | flags | SHA256(32) | XOR([GZip](container)) Key derivation: master = PBKDF2-HMAC-SHA256(password‖SHA256(key file), salt, iterations); enc key = HMAC(master,"SE2-ENC"), MAC key = HMAC(master,"SE2-MAC"), key-check = HMAC(MAC key,"SE2-KEYCHECK")[0..16]. Container (SEC1): entry count, total size, then per entry: path (UTF-8), modified time, attributes, length and data. Source code and development SecureEncrypt.cmd alone is enough to use the program. It is self-contained; the src\ and old_v5\ folders are not needed. Copy only this file to another computer or to GitHub releases. To change the code, edit the parts in src\. SecureEncrypt.cmd is a generated file; editing it directly is awkward (Turkish characters are stored as \u011f escapes, C# comments and indentation are stripped) and your changes are lost on the next build. Part Purpose launcher.bat Integrity check, starts the PowerShell program engine.ps1 Menus, prompts, install / uninstall lib.cs Crypto and archive core (also embedded in every _decrypt.cmd) dec.ps1 The decryptor embedded in every _decrypt.cmd stub.bat Batch start-up part of a _decrypt.cmd shim.js Right-click helper (multi-selection → one window) To make a change: 1) edit the relevant file in src\, 2) run powershell -File src\build.ps1 (regenerates SecureEncrypt.cmd and computes its SHA256 signature automatically), 3) to update the installed right-click copy, run SecureEncrypt.cmd and choose 1 (Update). Existing _decrypt.cmd files carry their own decryptor and are not updated; re-encrypt to get the new behaviour. Easy build (drag and drop): to build without typing a command, drag src\build.ps1 onto src\drag-drop_build.ps1.bat. The helper starts PowerShell elevated (a UAC prompt appears) with -ExecutionPolicy Bypass, so neither the execution policy nor opening an administrator window by hand gets in the way. The helper is for development only; it is not needed to use the program. The old v5 scripts are in old_v5\. v5 → v6: What Changed? (see the CHANGELOG.md file for details) Compatibility: the v6 file format is not compatible with v5's. _decrypt.cmd files created with v5 carry their own decryptor, so they are expected to keep working. Known limit: Windows does not show classic right-click commands when more than 15 items are selected. For more, drag and drop them onto SecureEncrypt.cmd. https://github.com/abdullah-erturk https://erturk.netlify.app https://github.com/abdullah-erturk/Secure-Encrypt
Really cool. Maybe very useful would be if it could also do optional splitting of the target file, for transportation over mobile media.
Win10+ certutil does not include spaces in hash powershell 4.0+ does not include it either running on Win8.1 will give false "SHA256 MISMATCH" because comparing hash without spaces vs. hash with spaces you can remove certutil spaces with extra command: Code: set "src_sha=%src_sha: =%" and for powershell: Code: $sha = (Get-FileHash -Algorithm SHA256 '%file%').Hash.Replace(' ','') + only powershell 5.0+ support ::new operator for creating objects previous versions require New-Object or [Activator]::CreateInstance IO.Compression.GZipStream CopyTo method is supported for PS 3.0+
My GitHub account was suspended for no reason. I'm trying to recover my account. I've added the source code to the thread.
I sent an email to GitHub support. I'm waiting for a response. @abbodi1406 I corrected the code according to your suggestion The certutil command assigns the hash (perhaps with spaces) to the src_sha variable. The set "src_sha=%src_sha: =%" command removes all spaces from this variable. Thus, the expected_sha variable is written to the _decode.cmd file as clean and without spaces. When the decoder script runs, the Get-FileHash command also produces a clean and without spaces in modern PowerShell. As a result, the comparison ($sha -eq '%src_sha%) now compares two clean strings and correctly returns the SHA256 VERIFIED message. This eliminates the need to add .Replace(' ','') on the PowerShell side since the data to be compared has already been cleared by the encoder.
v2 updated Changelog: Installer & Right-Click Menu Added Added an installer wizard that runs on double-click. It adds or removes the "Encrypt File (Secure Encode with AES-256)" option from the Windows right-click context menu. Administrator Privileges The script now automatically requests Administrator (UAC) privileges to handle registry and `C:\Windows` access required for installation/uninstallation. Directory Security Check A robust security check was added to prevent accidental encryption of files in critical system folders like `C:\Windows`, `C:\Program Files`, and the `C:\` root. Read-Only Attribute Handling The script now automatically removes the "Read-Only" attribute from an existing `_decode.cmd` file before overwriting it and sets the new file to "Read-Only" upon completion. Thus, the security of the encrypted data is partially ensured. abdullah-erturk/Secure-Encode: Secure Encode ---------------------------------- If you are looking for an advanced encryption program that also has a folder encryption feature, you can also review my work: abdullah-erturk/Encryption-Decryption-Tool: Easily encrypt and decrypt any file or folder you want in Windows environment.
I can find it useful to transfer files secure, without worry for external tools didn't think to do it in the past, but now, interesting option
Very cool approach. Is there a size limit? Ran it on a small iso ~ 50 MB (with Windows 7) and it does as advertised Isn't the split file option in tools like 7z a viable option? For the purist: you get exact same file but date/time stamp will not reflect original. No biggie btw Thumbs up
When encoding to base64, the actual file data grows by almost 33%, which means increased RAM usage for decoding. For this reason, the size limit generally caused problems above 1.5 GB in my tests. However, it works fine up to 1 GB. I'm currently exploring ways to completely disable base64 encoding, compress only files using Gzip, and encrypt them with AES-256. (With the help of AI ) If I can manage it, we'll be able to bypass the file size limit. This will allow us to use an encryption method like AES-256 only with cmd commands.
RAR format is proprietary commercial. Why don't you split the file into 1GB blocks, and process these individually? Would result in ~1.33GB target files in the end, and solve the memory issue. Processing in chunks is the common solution when working with large files.
v3 Changelog: ✨ New Features The AES-256 encryption method can now be used without any additional software, just by using Windows built-in programs (cmd + powershell) Script Integrity Protection: The main SecureEncyrpt.cmd script now verifies its own SHA256 hash before running. If the script has been modified or corrupted, it will refuse to run for security reasons. Password Verification (Sentinel): The decoder script now instantly verifies if the entered password is correct using embedded "magic bytes" (a sentinel). This check happens before attempting to decrypt the entire file, preventing wasted time and file corruption from a wrong password. Right-Click Menu Icon: The installer now adds a lock icon to the "Encrypt File" option in the Windows context menu for a better visual cue. Unicode Filename Support: Original filenames, including special characters and Unicode, are now correctly preserved. The script stores the filename as Base64 (Unicode) to prevent character corruption. Changes & Improvements Data Storage Method (Major Change): The file data is no longer converted to Base64. Instead, the raw binary data (either AES-256 encrypted or unencrypted) is appended directly to the end of the decoder script. Extraction Method (Streaming): The decoder no longer reads and decodes Base64 data. It now locates a DATA:: marker and streams the raw binary data directly from within itself. This method is significantly faster and more memory-efficient for large files. There is theoretically no file size limit for file encryption. Progress Bar (Encoder): The AES-256 encryption process now shows a live progress bar [======= ] 30% in the console. ️ Removed GZip Compression: The feature to compress the file using GZip has been removed. The file is now packed as unencrypted raw binary data, not compressed. Planned Features (To-Do) Auto-Splitting: Research and development is underway to automatically split files larger than 1 GB into 500 MB pieces. abdullah-erturk/Secure-Encrypt:
v4 Changelog: In unencrypted operations, data was written to the decrypt file as it is. XOR hiding was now added for text-based files (cmd, bat, vbs, txt, pdf etc.) Can be used as an alternative to Compressed2TXT abdullah-erturk/Secure-Encrypt
v5 Changelog: Folder encryption support has been added and many improvements have been made. Added multiple file/folder control. Don't pay for paid encryption programs. All you need is the Windows ecosystem. You can easily use AES-256 encryption for both your folders and files without any software dependencies.
v6 Changelog: v6 is a rewrite of v5. The old scripts are kept in old_v5\. Security Stronger key derivation: PBKDF2 (SHA-1, 10,000 iterations) → PBKDF2-HMAC-SHA256, 600,000 iterations (the count is stored in the file). Integrity check added: v5 had plain AES-CBC only; v6 uses AES-256-CBC + HMAC-SHA256 (encrypt-then-MAC). A modified or corrupted file is rejected before anything is written, and a wrong password is detected without decrypting the whole file. The password no longer appears on a command line: v5 put the password inside the PowerShell command ($password='...'); v6 reads it as a SecureString. Passwords with special characters such as & ! % " ' work. The original SHA256 is no longer written in clear text in _decrypt.cmd; it is stored inside the encrypted data. Key file (keyfile) support (instead of, or together with, a password; two-factor). The path can be typed, dragged in, or picked with a "Select file" dialog by typing ?. Password confirmation (asked twice) and a strength meter. Safe extraction: archive paths are validated (no .. escapes out of the target folder). 3 attempts in the decoder. Hardening: the iteration count read from a file is limited to 10,000,000; password and key bytes are wiped from memory after encrypting/decrypting; the right-click helper passes the paths in a list file instead of the command line (file names containing a %VARIABLE% pattern work too). See SECURITY_REVIEW.md. Delete-originals option: the output is first verified by decrypting and comparing, then deleted after your confirmation; locked files do not stop the run, files that could not be deleted are listed. No-password mode: v5 only XOR-obfuscated text files; v6 compresses and XOR-obfuscates all data in this mode (not security, it only keeps the content from being readable as plain text). Usability Multiple items: v5 handled one file or folder at a time; v6 bundles several files/folders into one _decrypt.cmd. New folder handling: v5 used ZIP (Shell.Application / VBS) for folders; v6 uses its own container format, so Windows 7 behaves like Windows 11. Empty folders, timestamps and attributes are preserved. New right-click menu: one neutral Encrypt entry instead of separate "Encrypt File" / "Encrypt Folder" entries, plus a Decrypt entry for *_decrypt.cmd files. A multi-selection is handled in one window instead of one window per item. Fewer questions: no output-folder question (encrypting writes next to the source, decrypting extracts next to the _decrypt.cmd). Advanced options (key file, delete originals) sit behind a single [y/N] question. Invalid yes/no input is asked again; conflict and menu questions are shown as lists. Conflict handling: overwrite all / rename / skip all / cancel. Automatic GZip compression (except for already-compressed types). One script, two languages: v5 had separate SecureEncrypt_TR.cmd and SecureEncrypt_EN.cmd; v6 is a single SecureEncrypt.cmd that opens in Turkish or English by Windows language (force with set SE_LANG=tr|en). Faster start-up: v5 started a separate PowerShell for every step; v6 runs one PowerShell program. Compatibility and internals Written for Windows 7 SP1 / PowerShell 2.0 and .NET 2.0, and tested on Windows 7, 10 and 11. Unicode support: file/folder names and the password can be in any language; the script is pure ASCII, so the system language / code page does not matter. It also works when the %TEMP% path contains characters outside the system code page. No third-party software needed: AES-256, PBKDF2, HMAC and GZip are done entirely with Windows' built-in components (cmd, PowerShell, .NET Framework). Development layout: the code is split into parts in src\; SecureEncrypt.cmd is generated by src\build.ps1, which computes the SHA256 signature automatically (v5 required updating it by hand and copied the script hash to the clipboard). src\drag-drop_build.ps1.vbs allows a drag-and-drop build. Compatibility notes The v6 file format (SEv2) is not compatible with v5's. _decrypt.cmd files created with v5 carry their own decryptor, so they are expected to keep working; new encryptions use the v6 format. Windows does not show classic context-menu commands when more than 15 items are selected; this is a Windows limit. For more items, drag and drop them onto SecureEncrypt.cmd.