Desktop documentation

Install or run portable

Download the package matching the Windows architecture.
Extract the entire ZIP before starting it. Do not run the executable from inside the ZIP viewer.
For portable use, start LockBox.exe. Keep all extracted files together.
For Explorer integration, use the installer or open Installed settings in LockBox.
Windows SmartScreen can show an unknown-publisher prompt for a newly distributed build. Verify the download source before continuing.

Portable mode is suitable for removable drives. Installed mode stores the app in the current user profile and registers only per-user HKCU integration.

In the installed edition, Installed settings lets you choose the default output folder and creation settings, including passwords, algorithms and layer keys. Save the creation defaults and then save the settings dialog. Explorer’s Quick create uses these saved values; if required defaults are missing, it opens settings. Secrets are protected for the current Windows account, so keep a separate backup of them before moving to another account or reinstalling Windows.

Create an encrypted container

Select the source folder and an output .lbx path on a different safe location.
Enter and confirm the master password.
Choose the number of encryption layers allowed by the current edition.
Select an algorithm and a unique key for every layer. Save those keys before continuing.
Review compression, padding, splitting and destruction-password options.
Read the summary and start. Keep LockBox open until the completion message appears.

The master password and all layer keys are required in their original order. Losing any one of them makes normal recovery impossible.

Master passwords and layer keys accept 1–512 printable ASCII characters: Latin letters, digits and punctuation, without spaces or line breaks. On each layer, choose the algorithm, use Generate key or enter your own key, and use Copy key to save it. Generate key replaces the displayed value; it cannot recover a lost key. Back and Next move between settings; check the final summary and save the final keys before starting.

Tray hides the window while work continues; reopen it from the tray icon. Exit and the close button are blocked during an active manual operation. With scheduled tasks, exiting offers to save them, exit without saving, or cancel. Saving tasks does not keep the scheduler running after exit: start LockBox and import the saved package for the next session.

Open and extract

Select the base .lbx file. For a split container, keep every numbered part beside it.
Select an empty or dedicated output folder.
Enter the master password so LockBox can read authenticated metadata.
Enter each layer key in the order shown by the metadata screen.
Start extraction and wait for the success message before using or moving the result.

An authentication failure normally means a wrong password, wrong key, wrong key order, missing split part, or modified container. LockBox does not return unauthenticated plaintext.

Container browser

The container browser is available only in Max edition. It decrypts a verified temporary browsing session, displays the archive tree and extracts selected files or folders. Use Extract selected for a small restore and Extract all for a complete restore.

On Windows, you can also drag selected entries from the tree into an Explorer folder. LockBox stages those entries in a temporary drag session. Temporary browser data is removed when its session ends; do not treat it as a backup.

Use the checkboxes for Extract selected; checking a folder includes its descendants. Highlighting names is a separate selection for dragging to Explorer: click one item, use Ctrl to add or remove items, or Shift to select a range. Dragging copies the highlighted entries. Extract all ignores both selections. Choose the destination when prompted and wait until copying finishes before closing the browser.

Scheduler

The scheduler is available only in Max edition.

Open Scheduler and create a task using the same validated create workflow.
Choose a future start date and one of the supported repeat frequencies.
Keep source and output locations available under the same paths.
Use Save as to export scheduled tasks to an encrypted .lbxjobs package.
Review last-success, last-failure and skipped-run status regularly.

Use the tray button to hide the window without stopping the scheduler. Desktop scheduled work runs only while LockBox remains open; Exit, Windows sleep, shutdown, unavailable drives and locked network shares can postpone or stop a run.

An exported .lbxjobs package contains task paths, settings, master and destruction passwords, and layer keys. Keep its file password separate and protect the package as secret data.

Click a task card to inspect its paths, next and previous runs, last success or failure, and skipped runs. Remove task is unavailable while that task is running. To change its settings, remove it and create a replacement. Import adds tasks to the current list rather than replacing it; importing the same package again can create duplicates. Review the next run after import and export the updated list.

Advanced container options

Edition limits

Edition	Layers and features
`Free`	Up to 1 layer with the basic 128-bit algorithm profiles.
`Pro`	Up to 3 layers, all algorithms, compression and container splitting.
`Max`	Up to 20 layers and every feature, including padding, browser, scheduler and destruction password.

Option behavior

Option	Purpose and warning
Compression	Reduces compressible data before encryption; already-compressed media may not shrink.
Cryptographic padding	Adds random encrypted bytes to obscure the exact content size; it increases output size.
Split container	Creates transport-sized parts. Every part is required for restore.
Delete source	Manual creation deletes the selected source after a successful output copy; scheduled creation deletes its contents. Verify backups before enabling either option.
Destruction password	Entering this special password during open intentionally destroys authenticated container material. It is irreversible.

Offline activation

Open the license dialog and copy the displayed device ID.
Obtain a signed Pro or Max license generated for that exact ID.
Paste the complete key and select Activate.
Confirm that the expected edition is shown after restart.

Activation is verified locally with a public signature key. A license copied from another device is rejected. Reinstalling Windows or materially changing the device identity can require a newly issued license.

Recovery and safety checklist

Keep at least one tested copy of the original data until a restore has succeeded.
Store passwords and layer keys separately from the container.
The creation summary and Show keys again dialog display the master password, destruction password and every layer key in plain text. Copy them only into trusted secret storage, then close the screen; never share a screenshot.
Do not edit, concatenate or rename only some split-container parts.
Do not interrupt power or remove the destination drive during final output copying.
Use a new destination for recovery when the existing folder contains valuable files.
Never test a destruction password against the only copy of a container.

Update and uninstall

For portable mode, close LockBox, extract the new package to a new folder and retain the old folder until the new build opens a test container. For installed mode, run the new installer. Use Uninstall integration to remove file associations, context-menu commands and shortcuts. Existing .lbx containers are user data and are not deleted by the uninstaller.

Troubleshooting

Double-click does not open .lbx

Run the installer again or re-enable Installed settings, then restart Explorer if its association cache has not refreshed.

The output drive runs out of space

Allow space for staging, padding and the final container. Compression savings are not guaranteed.

A scheduled run is skipped

Check whether an earlier instance is still running and whether both source and destination are available.

Extraction reports authentication failure

Verify the master password, every layer key, key order and all split parts against a known-good backup.

Plan and validate automatic backups

Start with a small test folder, then verify extraction and file contents before scheduling real data. Export live databases with their own backup tools first. Keep several dated versions on separate storage and preserve all split parts. Delete old backups only after a newer copy has been restored successfully. Source-deletion options are deliberately absent from the routine backup recipes.

Full CLI documentation

LockBox desktop documentation