Filename Privacy Options
When encrypting files with Necron Vault Manager, you can choose how the filename is handled. This page explains the two modes: plaintext filenames and encrypted filenames.
Why Filenames Matter
Even if the file content is encrypted, the filename itself can reveal sensitive information. For example:
medical-records-2026.pdf.ncrn— reveals the nature of the contentcompany-layoff-plan.xlsx.ncrn— exposes confidential project namespassport-scan.jpg.ncrn— indicates personal identity documents
Encrypted filename mode prevents this by replacing the original filename with a random-looking token.
Mode 1: Plaintext Filenames (Default)
When "Encrypt filenames" is turned off (the default for Quick Encrypt):
| Original | Encrypted |
|---|---|
report.pdf |
report.pdf.ncrn |
photo.jpg |
photo.jpg.ncrn |
budget.xlsx |
budget.xlsx.ncrn |
Best for:
- Personal use where filename privacy isn't a concern
- Situations where you need to identify files without decrypting
- Quick organization — you can tell which file is which at a glance
Mode 2: Encrypted Filenames
When "Encrypt filenames" is turned on:
| Original | Encrypted |
|---|---|
report.pdf |
a7B2x9KpQ3mNz8Wn1Rk.ncrn |
photo.jpg |
f3Yz8Wn1a7B2xKpQ3mR9.ncrn |
budget.xlsx |
Kp3mNz8Wn1RkQ9a7B2xY.ncrn |
The original filename is stored inside the encrypted file and automatically recovered when you decrypt.
Best for:
- Sensitive environments where filenames shouldn't be visible
- Cloud storage where the provider shouldn't know what you're storing
- Vault storage where nothing on disk should reveal the content
Warning
Do not rename .ncrn files on disk. The app expects a specific filename and renaming may cause decryption to fail.
Choosing the Right Mode
| Consideration | Plaintext | Encrypted |
|---|---|---|
| Privacy | Filenames visible | Filenames hidden |
| Convenience | Easy to identify files | Can't tell files apart without decrypting |
| Cloud storage | Provider sees filenames | Provider sees only tokens |
| Organization | Browse files by name | Need the app to browse |
| Vault usage | Not typical for vaults | Standard for vault storage |
Tip
For day-to-day Quick Encrypt operations on your local machine, plaintext filenames (the default) are usually fine. For vault storage or cloud-synced encrypted files, encrypted filenames provide stronger privacy.
Filename Mode in Different Workflows
| Workflow | Default Mode | Configurable? |
|---|---|---|
| Quick Encrypt | Plaintext | ✅ Toggle "Encrypt filenames" |
| Quick Decrypt | Auto-detected | N/A — follows the file |
| Vault Import (ADD FILES) | Encrypted | Always encrypted |
| Vault Browser | Encrypted on disk | Original names shown in the app |