Zero-Knowledge Toolbox · AI Productivity Engine·Your data — you are the only master
Where your data lives is up to you — but without your keys, no one can read it. This is the foundation of CosmosBox.
Data stays on your own device by default, fully encrypted; even when backed up to the cloud via WebDAV, only encrypted bytes are uploaded — the keys stay with you. No account to register means no account to leak.
We collect no usage data: no analytics, no crash reports, no behavior profiling. Your habits belong to you alone.
Your password is processed by the strongest recognized algorithms (Argon2id, using 128MB of memory) — GPU brute force is practically impossible. Every file is encrypted with its own random key (AES-256-GCM); changing your password automatically re-encrypts everything, and one corrupted file never affects the others.
Your password exists only in memory while unlocked and is wiped the moment you lock; data keys are held by the system secure chip (Android Keystore / iOS Keychain), isolated per tool.
Sensitive tools are granted one by one; a wrong password triggers delayed auto-lockout. You can also set a decoy password that opens a fake space — walk away clean in an emergency.
Enforced security policies, no dynamic code execution, per-permission grants — you decide what plugins can do, and every action is auditable.
.encbak encrypted backups are chunked with bounded memory use; self-hosted WebDAV cloud sync supported; even an interrupted restore leaves old data intact.
No analytics, no tracking, no ads. Disconnect from the network and every feature still works in full.
The client will be open-sourced (reproducible builds); every crypto implementation can be verified line by line — trust, but verify.
From "anyone who gets it can read it" to "password + salt, physically unbreakable" — the same data can sit at any of four security tiers.
Stored like a regular file; anyone who gets it can read it. Best for photos/notes you don't mind sharing.
Encrypted, salt travels with the file — enter your password on a new device and it's restored. The default tier.
The key (salt) lives only on this device — file leaks and password leaks both fail; moving devices requires the recovery code.
The file carries no salt; the salt is exchanged offline once — ciphertext, password and salt: all three are required.
The recovery code is a 32-byte true random number (256 bits of entropy) — every bit is the result of an independent coin flip. Breaking it means finding the right one among 2²⁵⁶ possibilities. 2²⁵⁶ ≈ 1.16 × 10⁷⁷, on the same order as the number of atoms in the observable universe. Suppose you turned every atom in the universe into a computer, each trying 10¹² attempts per second from the Big Bang until now — you'd still have covered only 10⁻²⁶ of the search space. The minimum energy required to exhaust a 256-bit key exceeds the Sun's total output over its entire lifetime. It's not "hard" — it's physically impossible. Quantum computers (Grover's algorithm) can only halve it to 2¹²⁸ — still unsolvable.
The recovery code can be split into 5 shares for friends and family (any 3 restore it — Shamir secret sharing). A single share is useless, so it's safe to hand out. Iron rule: write it on paper and lock it in a drawer — no photos, no cloud, no sending it to anyone. More Q&A in the FAQ →
Encrypted toolbox × AI productivity × Voice assistant × Plugin platform
Encrypted gallery (the camera shoots straight into it, never the system gallery), encrypted notes, encrypted contacts, password manager — the keys stay with you; switching devices restores via recovery code.
Bring your own API key (BYOK) to any compatible model: AI chat with web search gives real answers on weather and news; AI coding generates plugins and small/medium projects from one sentence, ready to use.
Switch themes, open tools, jot todos with a single sentence — an operations hub that understands commands. Volcano Engine speech synthesis sounds natural.
Know HTML/JS and you can build plugins that run in a secure sandbox. Plugin market, userscripts, file routing, AI one-click generation — an endlessly extensible ecosystem.
{
"projectName": "nebula-dashboard",
"type": "web",
"files": [
{ "path": "index.html" },
{ "path": "src/App.js" },
{ "path": "style.css" }
]
}Describe what you need in plain language → the cloud model generates a single-page plugin or a small multi-file project → it lands automatically in the app sandbox. Single-page plugins work instantly; heavy projects that a phone can't run wait for the desktop version / remote compute (planned).
From API debugging to dice rolls, from encryption to pomodoro
HTTP Tester · JWT Debugger · SQL Formatter · Cron Parser · Regex Tester · MQTT · IP Lookup · Certificate Viewer
AES / RSA Encryption · Password Vault · TOTP 2FA · Hash Tools · Password Generator
Markdown Editor · Text Diff · Morse Code · ASCII Art · Word Count · Pinyin Converter
QR Generate / Scan · Image Compressor · Format Converter · GIF Maker · EXIF Viewer
Pomodoro · Todo List · Notes · Flashcards · Calendar · Countdown · World Clock · HIIT Timer
Scientific Calculator · Compound Interest · Date · Percent · Unit / Currency / Timestamp / Base Conversion
Decision Wheel · Daily Fortune · Dice Roll · Discount Calculator · Bill Splitter · Age Calculator · Water Reminder
Device Info · Disk Analysis · Network Toolkit · Screen Tester · Decibel Meter · Level · Magnifier
The voice assistant isn't a chat toy — it's a real operations hub: 19 voice commands reach every corner of the app.
{
"id": "mobi.reader",
"name": "MOBI Reader",
"version": "1.2.0",
"entry": "index.html",
"permissions": ["file.read", "storage"],
"fileTypes": ["mobi", "azw3"]
}Plugins are web pages packaged as .cbplugin for one-click install. Sandbox isolation + permission declarations: open and secure at once.
This very page is the demo — click, and the whole site re-skins
CosmosBox v1.1.0 · Android APK · Free, no ads