VaporVault Got a Complete Makeover. Here's What's New.

VaporVault Got a Makeover

8:19

VaporVault Got a Complete Makeover. Here's What's New.

A couple of years ago I wrote about VaporVault as a concept. A private, offline, encrypted vault you physically own — no cloud, no subscription, no company holding a copy of your stuff. The idea was right. The implementation was held together with Arduino duct tape. Version 4.2.1 is a different product. Not an update. A rebuild. And I think it's finally at the point where I can talk about it without the asterisk.

Let me start with what changed under the hood, because it explains everything else.

The original VaporVault ran on a monolithic Arduino sketch. That's a fine way to prototype something. It's not a fine way to ship a security product. The architecture couldn't cleanly separate concerns — storage from networking, session management from cryptography, API from hardware control. Everything was tangled together in a way that made confident security claims impossible. 4.2.1 throws that out entirely.

The firmware is now a clean ESP-IDF component architecture — separate controllers for state, networking, sessions, cryptography, storage, API, and hardware. The kind of structure where you can actually reason about what each part does and what it touches. The kind of structure that makes security review possible.

That matters more than any feature on the list.

The encryption story is also different now.

Previous versions had... let's call it uneven at-rest protection. The new implementation uses AES-256-GCM with a random 256-bit data key that's wrapped by a PBKDF2-derived key from your passphrase. Your passphrase never touches your vault content directly — it unlocks a key that unlocks the data. That's how it's supposed to work.

Every note slot is encrypted. The three fixed encrypted slots — customizable names, color-coded — store whatever you put in them and keep it locked until you unlock the device with your passphrase.

Fresh Vaults require a real passphrase. No PIN bypass, no Quick Access shortcut that quietly skips meaningful authentication. If you're setting up a new device, you create a passphrase. That's the security boundary.

The two operating modes are worth understanding because they're genuinely useful and not confusing once you get the logic. Home Wi-Fi Mode connects VaporVault to your local network — your router, your house. From there you can access it from any browser on that network, your phone, your laptop, the VaporVault Console app on your Mac. The vault shows up at vaporvault.local if your router supports mDNS, or directly by IP if it doesn't. This is the mode you use at home, at your desk, when you want convenience.

Private Mode makes VaporVault its own Wi-Fi access point. You connect your phone or laptop directly to the device's private network — completely self-contained, no internet required, no router involved. This is the mode for travel, for situations where you don't have a trusted network, for anywhere you want the vault to be physically isolated. The private network has its own name and password that you set — separate from your vault passphrase, which is the thing that actually decrypts your content.

You switch between them with a triple press of the hardware button. No reflashing, no reconfiguration.

Onboarding was the biggest friction point in every previous version.

Getting the device set up — especially on Android — was a mess. Captive portals on mobile are unpredictable. Different phones handle them differently. The experience was bad enough that it undermined confidence in the whole product before you ever got to use it.

4.2.1 solves this with a USB-first commissioning flow. Connect VaporVault to a Mac or Windows computer, open the web installer in Chrome or Edge, pick your hardware target (C6 for production, C3 for compatibility), run a factory install, enter your Wi-Fi credentials right there in the installer. The device joins your network, and the installer opens the real local device address directly in your browser. You create your passphrase and you're in.

No Android captive portal. No guessing at IP addresses. The captive portal fallback still exists if you skip USB or something goes sideways, but the primary path is clean.

The VaporVault Console is new and worth calling out separately.

It's a native macOS desktop app — built on a Native SDK using Zig — that gives you full access to your vault from a real application window rather than a browser tab. Same responsive interface as the device-hosted UI, which means it's maintained once and works everywhere. Version 1.2.1 shipped alongside the firmware. For people who primarily use VaporVault at a desk, this is the way to interact with it.

Two features I want to flag because they solve problems I've thought about for a while.

Encrypted device cloning. If you want to move your vault to a new device, or keep a second device as a backup, you can clone directly from one unlocked VaporVault to another on the same local network. The transfer is encrypted — AES-256-GCM over the local connection. One operation, both devices end up with identical vault content. No exporting, no importing, no intermediary file sitting on a laptop somewhere.

Media & Links. In Home Wi-Fi Mode, there's now a dedicated tab for links and media. YouTube embeds inline. Regular links launch locally. This is a small thing but it's the kind of thing that matters for daily use — your vault isn't just a place for passwords and notes, it's a place for the links and references you want to keep private and accessible.

Here's where VaporVault sits right now, honestly.

It's ready for the use case it was always designed for: a practical personal privacy appliance for everyday people who want to keep sensitive information under their own control. Passwords and recovery codes. Household emergency information. Account details. Private notes. The kind of stuff that shouldn't live in a notes app that syncs to the cloud automatically.

It is not yet claiming hostile-network protection. Authenticated encrypted transport over the local connection is still an open item — the API is local HTTP in this build. That's fine for a trusted home network. It's not a claim you should make in a coffee shop on someone else's network. The team is clear about this distinction and the documentation says so explicitly. I respect that more than I would respect a vague claim that everything is locked down.

The next security tier — dedicated secure element, device-bound cryptographic identity, keys generated inside hardened hardware, authenticated encrypted transport, signed firmware — is the roadmap. This version is the foundation it gets built on.

If you've looked at VaporVault before and moved on because the implementation didn't match the concept, 4.2.1 is worth another look. The concept was always right. Private, local, physically owned, no cloud dependency, simple enough for everyday use. The execution is now at a level where I can say that without qualifying it to death.

You can find current firmware, the web installer, and the Console at richwashburn.com/vaporvault.

Standard and Pro builds are both on 4.2.1. Same firmware, same features, different hardware configurations for desk use versus portable battery operation.

If you're setting one up for the first time, use the USB workflow. It's the right path.

---

Rich Washburn is a technologist and strategist working at the intersection of AI, infrastructure, and capital. He is Managing Partner and Chief AI Officer at Eliakim Capital and CIO of Data Power Supply.