Cloud storage · checked 2026-10-20Can I vibecode Tresorit?
KINDA· weekend project
Encrypting files before they leave your machine is a solved problem: an agent can wire a well-known library such as age to a storage bucket and a version index in a weekend, and the result keeps the provider blind to your names and contents. The weekend goes on trust, not code: recovering from a lost laptop, never losing the key, and sharing a file with someone who has no setup. A homemade vault has no independent audit, no phone app and no one to call, which is what Tresorit is selling to people who handle other people's files.
$5.99/moprice
$72you'd save a year
weekendbuild time
—people replaced it
What you need on hand.
DifficultyIntermediate · Some system setup or keys.
TimeA weekend; testing recovery on a clean machine takes the longest
- Claude Code, Codex or CursorAny of them can run the prompt.
- Python 3.12 and uvpyrage ships prebuilt wheels for common platforms.
- An S3-compatible bucketBackblaze B2 lists $6.95 per TB a month and the first 10 GB are free.
- An offline copy of the identity fileWithout it nothing can be decrypted, by you or anyone else.
- A second computerUsed once to prove you can restore with nothing but the key and the bucket keys.
Before you buildTresorit Basic is free with 3 GB, and Cryptomator encrypts a folder inside any cloud storage you already have at no cost. If you only need a few documents locked, start with those.
- 1. Install one agent: Claude Code, Codex, Cursor.
- 2. Make an empty folder and open it in the agent.
- 3. Paste the prompt below, press enter, and answer its questions as it builds.
The prompt
Build me a personal encrypted file vault to replace Tresorit. Requirements:
- Python 3.12 with `uv`: one CLI `vault` (Typer) with the commands init, push, pull, ls, restore,
share and verify. Never write your own cryptography: files and the index are encrypted with
age through `pyrage`.
- `vault init` creates an age identity at ~/.config/vault/identity.age, itself locked with a
passphrase typed at the prompt, and prints the public recipient. Say clearly that losing the
identity means losing every file, and print how to keep an offline copy.
- Storage: an S3-compatible bucket through `boto3`, with endpoint, bucket and keys in .env. Each file
is split into 8 MiB chunks, each chunk is encrypted on its own and stored under a random 128-bit
name, so the bucket never sees a file name.
- Index: SQLite at ~/.local/share/vault/index.db (path, size, mtime, chunk list, version). After
every push, upload it encrypted as index.age so a new machine can run `vault pull --bootstrap`
with only the identity file and the .env keys.
- `vault push ~/Vault` uploads new and changed files and `vault pull` fetches what is missing. A
file changed on two machines keeps both ("name (conflict 2026-10-20 laptop).ext"). Deletions
are soft: nothing leaves the bucket for 30 days. Keep the last 10 versions and offer
`vault restore <path> --version N`.
- `vault share <path> --days 7` encrypts the file with a fresh random passphrase in age's passphrase
mode, uploads it under a random name and prints a presigned URL and the passphrase on separate
lines. Ship a static decrypt.html that uses `age-encryption` (typage) to decrypt in the browser
from a file the recipient picks, with no network calls.
- `vault verify` downloads 5 random chunks, decrypts them and checks their hashes. Tests with
`pytest`: a round trip, a flipped byte making decryption fail, rebuilding the index from
index.age on an empty machine, and version pruning.
- Single user. No accounts, no telemetry, local-first. Outbound calls: your bucket only.
- Out of scope: mobile apps, live sync, virtual drives, multi-person sharing, key exchange, audits.
- README: a threat model in plain words (the bucket owner sees object counts, sizes and timing, not
names or contents), how to back up the identity file, and a warning to keep Tresorit until a
restore on a clean machine has worked.Opens your agent with the prompt filled in, you press enter. Or copy it and paste it into an empty folder.
Then keep going
Next prompts, same folder.
The first prompt builds the core. Run these one at a time in the same folder to grow it into your own Tresorit.
Add a watcher to the encrypted vault in this folder. Requirements: - `vault watch ~/Vault` uses `watchfiles` to notice changes, waits until a file has been quiet for 5 seconds, then runs the same push logic as `vault push` for that file. - Ignore patterns from a .vaultignore file in gitignore syntax and skip temporary files such as *.tmp and ~$*. - Every 10 minutes run `vault pull` so changes from other machines arrive. - A launchd plist and a systemd user unit, and a log at ~/.local/state/vault/watch.log. - Update the README.
Add a restore drill to the encrypted vault in this folder. Requirements: - `vault drill` creates a temp folder, bootstraps an empty machine from the identity file and the .env keys, restores 20 random files and compares each one's SHA-256 with the index. - Print a pass or fail line per file and write the date of the last passing drill to ~/.local/state/vault/last-drill. - `vault ls --status` warns in red if the last passing drill is older than 90 days. - Never write into the real Vault folder. Update the README.
Extend the encrypted vault in this folder to support several age recipients. Requirements: - `vault recipient add <name> <age1...>` and `vault recipient rm <name>` keep a list in the encrypted index; new files are encrypted to every listed recipient. - Files already in the bucket are re-encrypted only when `vault rekey` is run, which prints how many chunks it will rewrite and asks for confirmation. - Removing a recipient does not revoke what they already downloaded: say so in the command output and in the README. - Tests for adding, removing and rekeying.
What you lose
- Published audits and certifications such as ISO 27001, which a homemade tool cannot have
- Desktop and phone apps with sync, camera upload and document scanning
- Share links with expiry, password options, access logs and file requests built in
- Restoring deleted files and wiping a lost device remotely, handled for you
- Tresorit's Swiss ownership, data centres and a support team to call
Why people still pay
People pay Tresorit so they do not have to trust their own cryptography. The company says it cannot read your files and backs that with audits and certifications, and the apps cover sync, sharing and a lost laptop. For an accountant, a lawyer or a freelancer holding client files, an audited vendor is a better answer than a script someone wrote on a weekend.
Tresorit or your own copy?
Over
Your usage
12h ×$/h
Tresorit, 1 yr$72
Your own copy, 1 yr$50running + build session
You keep$22pays for itself in 4 months
Estimate · Backblaze B2 lists $6.95 per TB a month with the first 10 GB free: about $0.35 for 50 GB and $6.95 for 1 TB, with downloads free up to three times your stored data. The build is token usage on your agent plan.
Take your data, then cancel.
1 · Take your data out of Tresorit
- 1Install the Tresorit desktop app and sync the folders you want onto your disk; synced folders keep a full local copy that stays available offline.
- 2The web app lets you view, download and upload files but does not sync folders, so it suits grabbing a few files rather than everything.
- 3Tresorit Drive shows cloud files in your file manager without storing all of them, and is not a true sync: do not count it as a backup.
- 4A file you download is a one-time copy that stops tracking the cloud version, so move the whole folder once and stop editing in Tresorit.
2 · Cancel Tresorit
- 1Cancel anytime in the Admin Center; the cancellation takes effect at the end of the current paid period and you keep the features until then.
- 2After it ends, the account falls back to the free Basic plan: 3 GB, 500 MB per file, two devices and ten active links.
- 3Unused time is not refunded; a direct purchase without a trial has a 7-day money-back guarantee (14 days for EU consumers), and a subscription converted from a trial is non-refundable.
- Cancel before a trial ends: a trial that runs out converts into a paid subscription.
- Basic accounts are deleted with their data if you do not log in for 210 days, so keep a login reminder if you park files there.
- Switching from monthly to yearly is self-service, but yearly back to monthly needs a message to support.
- Repoint shared links before the plan ends; links on a Basic account are limited to 10 active ones of up to 250 MB.
The escape hatch
Don't feel like building it? These are already free.
CryptomatorOpen sourceGPL-3.0 client-side encryption that turns a folder inside any cloud storage into a vault you open as a drive.★ 16k · active Oct 2026 · one-click install
desktop, iOS, AndroidVisit ↗rcloneOpen sourceMIT command-line sync to dozens of storage providers, with a crypt remote that encrypts names and contents before upload.★ 60k · active Oct 2026 · one-click install
desktopVisit ↗NextcloudOpen sourceAGPL-3.0 file platform you run yourself, with optional end-to-end encrypted folders that come with feature limits.★ 37k · active Oct 2026 · docker to self-host
Web, desktop, iOS, AndroidVisit ↗
desktop, iOS, AndroidVisit ↗rcloneOpen sourceMIT command-line sync to dozens of storage providers, with a crypt remote that encrypts names and contents before upload.★ 60k · active Oct 2026 · one-click install
desktopVisit ↗NextcloudOpen sourceAGPL-3.0 file platform you run yourself, with optional end-to-end encrypted folders that come with feature limits.★ 37k · active Oct 2026 · docker to self-host
Web, desktop, iOS, AndroidVisit ↗
The numbers
Tresorit pricing
| Plan | Monthly | Annual, per month | What you get |
|---|---|---|---|
| Basic | $0 | $0 | 3 GB of storage, 500 MB per file, no file versions, 1 day of activity history, up to 2 devices, 10 active shared links of up to 250 MB. |
| Personal Lite | $5.99 | $4.75 | 50 GB of encrypted storage, 2 GB per file, 5 versions, links up to 2 GB, sync on 2 devices, camera upload, restore deleted files, remote wipe, a Gmail and Outlook plugin for encrypted attachments. |
| Personal Essential | $13.99 | $11.99 | 1 TB, 10 GB per file, 10 versions, links up to 2 GB, sync on 10 devices, document scanning in the app. |
| Personal Pro | $33.99 | $27.49 | 4 TB, 10 GB per file, 25 versions, links up to 5 GB, sync on 10 devices, advanced link security, file requests, PDF annotation on iOS and detailed access logs. |
| Business plans | custom | — | Team storage, admin controls, branded data rooms and an eSign add-on, sold on separate business pages. |
- Free tier
- 3 GB in total, 500 MB per file, no version history, two devices and ten active links.
- Billing
- Monthly or yearly, with the yearly toggle marked 20% off. Accepted currencies are EUR, USD, CHF and GBP depending on location; the prices here are the US dollar view. A 14-day trial is offered and converts to a paid plan unless cancelled; a direct purchase without a trial has a 7-day money-back guarantee (14 days for EU consumers); converted trials are not refundable. Monthly can be switched to yearly in the Admin Center, but yearly to monthly means contacting support.
- Hidden costs
- Lite allows 2 synced devices and 50 GB; a phone, laptop and desktop already means Essential. Tresorit gives no refund for unused time after cancelling, and going back to Basic with more than 3 GB stored means trimming files.
- Source
- tresorit.com
Also on the list
Related apps
The Basic plan is free: 3 GB of storage, 500 MB per file, two devices and 10 active shared links.
Kinda. The core is a weekend build with the prompt on this page, but real gaps remain: Published audits and certifications such as ISO 27001, which a homemade tool cannot have, Desktop and phone apps with sync, camera upload and document scanning.
About $5.99 a month on the Personal Lite plan, $71.88 a year (checked 2026-10-20).
Published audits and certifications such as ISO 27001, which a homemade tool cannot have; Desktop and phone apps with sync, camera upload and document scanning; Share links with expiry, password options, access logs and file requests built in; Restoring deleted files and wiping a lost device remotely, handled for you; Tresorit's Swiss ownership, data centres and a support team to call. If any of those matter to you, keep paying.
Yes: Cryptomator (open source), rclone (open source), Nextcloud (open source).