AXIOM OS
AXIOM OS
AXIOM OS runs your vault, notes, files, and messages behind a single encrypted desktop. Your key is derived on-device with scrypt, used only in memory, and never sent anywhere.
Every window, decrypted only into memory.
Every built-in app runs in its own sandboxed window. Nothing renders until it's decrypted in memory — nothing survives after you lock up.
Your data never touches a centralized server. The master key is derived on your machine, held in memory, and destroyed the moment you lock.
The derived key lives strictly in volatile RAM. Locking, logging out, or quitting overwrites the buffer with zeroes before it's dereferenced.
Notes, credentials, and settings sit in a local SQLite database. Sensitive fields carry their own randomized IV and authentication tag.
Deleted files are overwritten with zeroes, then ones, then random bytes, then flushed to disk before unlink. Deleted means gone.
AXIOM OS supports decoy profiles. If you're ever forced to unlock, a decoy password opens a separate workspace of benign fake notes and placeholder files — your real vault stays invisible. Press Ctrl / Cmd + Shift + L at any time to lock instantly and scrub the key from memory.
Each app is encrypted independently and decrypted only into memory while you're using it.
No signup, no telemetry, no cloud account. Pick a platform and go — or read the source first, we'd expect nothing less.