README file from
GithubFolder Crypto
Local Obsidian plugin with two folder-protection modes.
Folder lock
Folder lock is the master switch for locking the configured folder in Obsidian.
This mode locks a folder inside Obsidian. A locked folder shows a lock badge in the file explorer, while its child files and subfolders are hidden from the file tree. Clicking the locked folder asks for the password. When a file inside that folder is opened from another route, the plugin also asks for the password. After successful unlock, every file in that folder is visible and readable until Obsidian is closed or Lock all Folder Crypto folders is run.
Sync Finder folder lock is the small switch under it. When enabled, folder locking also hides the underlying folder in Finder with chflags hidden. Unlocking shows it again with chflags nohidden. It does not change read permissions, so Obsidian can still open and scan the vault.
Commands:
Lock configured folder in ObsidianUnlock configured folder in ObsidianLock all Folder Crypto foldersRemove configured folder lock
Folder right-click menu:
Lock folder in ObsidianUnlock folder in ObsidianRemove Obsidian folder lock
This is still not encryption. Finder hiding is only a convenience layer and can be bypassed by other apps, Terminal, backups, sync history, admin access, or already-open cached content.
Content lock
Content lock is the master switch for content encryption. Turning it on encrypts the configured folder after confirmation and password entry. Turning it off blocks new encryption operations; encrypted files are not automatically decrypted.
This mode rewrites file contents into an encrypted envelope. Use it when the file contents should be unreadable outside Obsidian too.
Commands:
Encrypt configured folderDecrypt configured folder
Folder right-click menu:
Encrypt folder with passwordDecrypt folder with password
Passwords for content encryption are never saved. Files are encrypted with AES-256-GCM and a PBKDF2-derived key.
If Create plaintext backup is enabled, .ofc-backup files are written next to encrypted files. This is safer during testing but leaves readable plaintext in the vault.