Every guarantee, paired with the attack it doesn't cover.
This page is written for the 3% of visitors who will read it — and for everyone who trusts their recommendation. It describes what Obscured Media protects, how, from whom, and what no local-first software can honestly promise.
Wrap keys. Never re-encrypt data.
Every file, its own key
Each protected file is encrypted with chunked AES-256-GCM under its own random data-encryption key. Chunks are individually authenticated, so playback can seek anywhere in a multi-gigabyte file without ever materialising it in plaintext.
Your password wraps — it doesn't encrypt
An Argon2id-protected master key wraps the per-file keys. Changing your password rewraps one 32-byte value; your media is never rewritten. A separately exported recovery file independently unwraps the same key, so recovery needs no cloud and no copy of anything.
The catalogue is sealed too
Filenames, paths, tags, ratings, playlists, history, thumbnails — even the fact a folder once existed — live only inside an authenticated, encrypted SQLite catalogue. Tamper with a sealed record and it fails authentication rather than lying to you.
Discovery is never authentication.
Server Mode is deliberate and temporary — never on by default, never reachable beyond the private subnet it can prove it's on.
| Layer | What actually happens |
|---|---|
| Identity | Every server has a stable cryptographic identity (an SPKI fingerprint) that survives certificate renewals and address changes. Clients pin it on first use — a different key at the same address is refused, loudly. |
| Pairing | Headsets pair with six digits you approve on the PC; no password is ever typed in VR. Trust is a revocable credential the server can verify but never reproduce. |
| Sessions | Short-lived, memory-only, bound to device and security epoch. Locking the library revokes every token, grant and open stream — mid-transfer if necessary. |
| The API | Read-only by construction. There is no route for a remote device to modify, delete, export or reconfigure anything — the attack surface cannot express what the threat model forbids. |
| Your firewall | Three narrow inbound rules, private-profile and local-subnet only, created with one explicit admin approval. Never a public-network rule, never UPnP, never a hole in your router. |
| Updates | "Check for updates" simply opens www.obscured.media in your browser — that's the whole mechanism. The app itself never connects to us: no update pings, no version beacons, no telemetry. There is no server to phone home to. |
Architectural, so you don't have to take our word
It never leaves your hardware
No cloud catalogue, no storage service, no upload path, no telemetry, no account. The free tier makes no network connections at all. There is nothing to breach on our side, because there is no "our side."
You'll never pay to get your files back
Exact restore is permanently free and works offline with your password or recovery file. The on-disk format is documented, and a free, open-source command-line decryptor ships at launch — so this survives even us disappearing.
We can't see what you keep
Not a policy — an architecture. No route exists by which a filename, thumbnail or byte of content could reach the developer. Diagnostics are local, opt-in, bounded, and filtered so secrets and content are rejected by name and shape.
What no local-first software can promise
If a privacy product won't tell you its limits, it's telling you something else. Here are ours, in the same plain language the app itself uses.
Fast Mode is concealment
It defeats browsing, thumbnailing and casual opening in seconds — and it is honestly labelled "not encryption." Secure Mode is the encryption. The app never blurs the two.
Streaming is not DRM
Authorising a device means trusting it. A device you trust can record what it plays. Basic-TV casting additionally sends that one video unencrypted across your own network — and says so before the first cast.
Deletion is not forensics
Deleting is deliberate, journalled and verified — but no software can promise forensic erasure from modern SSDs, backups, snapshots or sync copies. We won't claim otherwise.
A compromised computer wins
Keyloggers, screen capture, memory forensics, a hostile administrator — these defeat any local application, including this one. Obscured Media protects data at rest and in motion on your network; it cannot protect a machine you've lost control of.
Suspicion is healthy. Here's what to check.
Open the folder
Protect a test file, then look at the disk. You'll find an anonymous .bak object — not your file with a lock icon. Try the same test on any "private player" and compare.
Watch the network
Run the free tier with a firewall monitor. You'll see zero outbound connections — no licence pings, no analytics, nothing. A promise you can watch being kept.
Read the evidence
Every capability claim on this site traces to committed acceptance-evidence files with named tests and build hashes — including explicit "not run" entries where hardware testing is still open. We publish the gaps, not just the passes.