CLI Reference

Creates a vault and sets its passphrase. The folder is created if it does not exist, and may already contain documents — they are left alone until you add them.

Prints a 24-word recovery code once, and asks you to confirm you have written it down. It is not stored anywhere and cannot be shown again.

Calibrates Argon2id to about one second on the machine doing the work, then records those parameters in the vault, so the cost is right for your hardware and the vault stays openable later.

Refuses if a vault already exists there, so a mistyped repeat cannot destroy your keys.

Suggests a passphrase drawn from EFF's Long Wordlist using the operating system's random source. Touches no vault, saves nothing, changes nothing — it works before you have created a vault.

Prints exactly one suggestion and never a menu: picking a favourite from several is a human choice layered over a random one, which is what machine selection exists to prevent.

The passphrase goes to stdout and everything else to stderr, so `encino passphrase > file` gives a clean file while any warning still reaches you.

Imports files and folders, encrypting them into the vault. Folders are walked recursively. The vault's own .encino directory is never descended into.

A document's name is its path relative to the folder you named, so the named folder becomes the top of the imported tree — the same rule as cp -r. Files already inside the vault keep their position in it, so `add .` after dropping documents into the folder preserves whatever structure you put there.

By default, originals are shredded only if they were already inside the vault folder. Anything imported from elsewhere is copied in and left where it was, and encino says which happened. That default is deliberate: `encino add .` run from the wrong directory would otherwise shred every file in that directory, with nothing to alert you until you went looking for something.

A name that already exists is refused, as is one differing from an existing document only by case — so a vault written on Linux stays openable on Windows and macOS.

Lists the documents held, ordered by name, with sizes and a total. Anything currently decrypted is marked DECRYPTED. Sizes shown are the documents' real sizes, not their padded sizes on disk.

Decrypts documents into the vault folder, where they stay until you close them. Subfolders are recreated as needed.

Plaintext is staged inside .encino and moved into place only once it decrypts and matches the digest recorded in the index, so a failure never leaves a partial document that looks whole.

Opening a document that is already open is refused.

Re-encrypts documents and shreds their plaintext.

A document that comes back byte-for-byte unchanged keeps its existing ciphertext — reading a statement and closing it again costs no re-encryption. One that was edited is re-encrypted under a fresh key and its old ciphertext is removed.

Empty folders left behind are tidied away, so the vault folder returns to holding nothing but .encino.

If any document cannot be closed, the command says which and exits 1 — its plaintext is still on disk.

Starts a session so later commands do not prompt again. Derives the key once — Argon2id is deliberately about a second — and hands it to a background agent that holds it in memory locked out of swap.

Writes nothing to disk and decrypts nothing. Authentication and exposure are separate: unlock proves who you are, open is the only thing that puts plaintext on the filesystem.

If a session is already running it says how long remains and does nothing else.

Reports the vault path, whether a session is open and how long it has left, how many documents are held, and — loudly — anything currently decrypted.

Works without a session, in which case it reports locked and stops there without asking for a passphrase.

Closes everything still open, stops the agent, and forgets the key.

Documents are re-encrypted before the key is dropped, since re-encrypting them needs it. If any cannot be closed, the session is deliberately left open and the command exits 1 — locking would otherwise leave plaintext on disk with no way to re-encrypt it short of entering the passphrase again.

Safe to run when no session exists; it does nothing and succeeds.

Changes the passphrase. Asks for the current one, then the new one twice.

Rewrites only the wrapped master key, so no document is re-encrypted however many the vault holds. Your recovery code is unchanged and still works.

Opens the vault with the 24-word recovery code instead of the passphrase, and offers to set a new passphrase.

The code is read with echo on — it is transcribed from paper, and twenty-four words typed blind is how a recovery fails at the worst moment. Spacing and case do not matter; the BIP39 checksum catches transcription errors before anything is attempted.

Declining to set a new passphrase changes nothing.

Authenticates every stored document against the index: confirms each blob is present, its key unwraps, it decrypts, and its digest matches what was recorded. Also reports stored blobs no document refers to.

Reads everything in the vault, so it takes time proportional to total size. Exits 1 if anything is wrong.

Decrypts the whole vault into a directory, preserving folder structure. The vault is left untouched.

Asks for confirmation, because the result is plain readable files that encino no longer protects.

This exists so a vault is never a one-way door. Worth running once on a test vault to prove you can always walk away with your documents.