Using QNSQY: GUI, TUI & CLI

In the left rail under CORE, click Encrypt.

Under Source, click File (or Folder) and choose what to encrypt.

Under Destination, set where the encrypted .qs file is saved (defaults to the input name + .qs).

Under Encryption Method, pick Password (default), Public Key (recipient), or Password + Key (hybrid). Optionally expand Options / Advanced for compression, paranoid padding, algorithm, and Argon2 strength.

Click Encrypt. A secure prompt opens for your password (entered twice); it is never shown on screen and is passed to the engine over stdin. The result is a quantum-resistant .qs file, confirm it round-trips with Decrypt (or the CLI tab below, which we verified produces a byte-identical file).

Open Decrypt from the CORE section of the left rail. The screen has an Encrypted File picker, a Destination path, a Decryption Method (Password by default), an optional Signature Verification field, and Options / Remote Restore toggles.

Browse to the encrypted .qs file, set the Destination path, and leave Method on Password (or switch to a private key for a recipient-encrypted file). To check a signature, browse to the signer's public key under Signature Verification.

Click Decrypt. You are prompted for the passphrase (never echoed); the original bytes are recovered exactly, byte-for-byte.

Open Keys from the CORE section. One screen holds two cards: Generate Encryption Keypair (ML-KEM / FIPS 203) and Generate Signing Keypair (ML-DSA / FIPS 204).

In the card you need, enter a Name, optionally toggle Protect private key with passphrase, and pick a Security Level (encryption defaults to ML-KEM-512 with the X25519 backup checkbox on; signing defaults to ML-DSA-44). Choose a Save to folder.

Click Generate Encryption Key (or Generate Signing Key). Two files are written: the private key (keep secret) and the .pub public key (share). The private key is never displayed.

Open Sign / Verify from the CORE section. The screen has a Sign File card (File to sign + Private key) and a Verify Signature card (Signed file + Public key).

To sign: browse to the file and your private signing key. The screen warns that signing modifies the file IN PLACE (the signature is appended, no separate .signed copy), so keep a backup if you need the unsigned bytes. To verify: browse to the signed file and the matching public key.

Click Sign (you are prompted for the key passphrase if one is set), or click Verify. Verify reports VALID or INVALID and shows the algorithm and key hash.

Open Vault from the CORE section. The Secure Vault screen has three tabs (Browse, Add Entry, Settings) and opens on Browse with an Open Vault panel.

On the Browse tab, use the .qsv file picker to select your vault (or create one on first use), then enter the master password. Switch to Add Entry to store a new username/password, optionally auto-generating a random password.

Click Unlock Vault. The vault file is itself post-quantum-encrypted; the master password unlocks it and the decrypted entries stay in memory only.

Open Remote Backup from the CORE section. The Destination panel configures where encrypted data is stored (R2 / S3 / MinIO / your own server). The Enter endpoint directly toggle is on, exposing Provider, Endpoint, Bucket, Region, Access key, Secret, and an optional ML-DSA-87 Signature pin.

Choose a Provider, fill in the Endpoint and Bucket (Region defaults to auto). Enter the Access key / Secret, or leave both blank to use QNSQY_REMOTE_ACCESS_KEY / QNSQY_REMOTE_SECRET from the launch environment. Optionally pin a signing public key and save it as a named profile.

Click Test Connection to confirm the remote, then push, pull, or sync. Data is encrypted locally before upload, so only ciphertext leaves the machine (zero-knowledge).

Open the QNSQY desktop app and choose Batch under OPERATIONS in the left rail. The Batch Operation panel opens.

Pick the Operation (Encrypt, Decrypt, or Verify) and the Mode (Password is shown here). Click + Add File to build the list, set an optional Output directory, and flip Compress or Paranoid padding if you want them. Parallel jobs defaults to Auto (CPU count).

Click Encrypt All. QNSQY prompts for the password once, then processes every file and writes one .qs per input into the output directory.

Open the app and choose Threshold under OPERATIONS. The screen stacks three tools: Split Secret (Shamir M-of-N), Combine Shares, and (scroll down) Threshold Encrypt.

To split a secret, browse to the file, set Required (M) and Total (N) (defaults 3-of-5; flip Custom M/N values to change them), choose an output directory, and click Split. To reconstruct, add the share files under Combine Shares, set the threshold, and click Combine.

To encrypt to a set of recipients instead, scroll to Threshold Encrypt, add each recipient’s public key and the number required (M), then encrypt, any M of the N key holders can later decrypt together.

Open the app and choose Hash under TOOLS. QNSQY computes the digest in-process (no subprocess).

Browse to the file and pick the Algorithm (BLAKE3 by default; SHA-2, SHA-3, and SHAKE are in the list). Click Compute Hash and the digest shows under Result.

To check a file against a known digest, paste it into Expected hash (verify) and click Verify, QNSQY reports whether it matches.

Open the app and choose Secure Delete under TOOLS. It overwrites the file’s bytes, then unlinks it.

Browse to the file you want destroyed and set Passes (3 by default; more passes overwrite the data more times).

Click Delete Permanently. QNSQY overwrites the file the chosen number of times, then removes it. This cannot be undone.

Open the app and choose Encoding under TOOLS. Conversions run in-process.

Set Mode to Encode or Decode and pick the Format (Base64, Base64URL, Hex, Base32, Base32Hex, Base58, URL, Binary, Octal, or Decimal). Paste or type your data into Input.

Click Encode (or Decode). The converted data appears under Result, and Copy Result puts it on the clipboard.

Open the app and pick Random Gen from the TOOLS group in the left rail. The Random Generator screen appears with a Generate panel above an empty Result panel.

Choose a Type (Password is shown) and a Length in characters (20), then set the Uppercase, Numbers, and Symbols toggles. All three are on by default.

Click Generate (bottom right). The value appears in the Result panel. Every value is drawn from the OS CSPRNG (getrandom) and is never stored or logged.

Open the app and choose Verify Integrity from the TOOLS group in the left rail. The File Integrity Check screen appears with a file picker and an empty Result panel.

Click Browse and select the encrypted .qs file you want to check. No password is required; this reads only the header.

Click Verify Integrity. The Result panel reports whether the encrypted header is authentic and unmodified. The screen also shows an Equivalent command line with a Copy button.

Open the app and choose Stego from the ADVANCED group in the left rail. The Steganography screen opens on the Hide tab, with an Extract tab beside it.

Fill the three file fields with Browse: the Secret file to hide, the Carrier file (image, PDF, audio, or video), and the Output file. Then choose a Method (Password is shown) and a Cipher (AES-256-GCM).

Click Hide Data to embed the encrypted secret into the carrier, or Capacity first to check how much the carrier can hold. The live Equivalent command line mirrors your choices.

Open the app and choose Polyglot from the ADVANCED group in the left rail. The Polyglot Files screen opens on the Create tab, with Extract and Detect tabs beside it.

Pick the Secret file to embed, then a Carrier file (PDF, ZIP, PNG, or JPEG) and an Output file. Optionally turn on Triple-carrier mode (one file = JPEG + ZIP + PDF) or Self-extracting, and add recipients under PQC Hybrid Encryption for KEM instead of password-only.

Click Create Polyglot. The output opens normally in its host application while carrying your encrypted payload inside. The Equivalent command line updates as you configure.

Open ABE under the ADVANCED group in the left rail. The screen opens on the Encrypt tab, with a row of tabs across the top: Encrypt, Inspect Policy, Authority, Issue, Seal, and Open. The panel header reads “Encrypt with Policy” and notes that recipients whose attributes satisfy the policy can decrypt with their normal private key.

Choose the input data with Browse, paste the recipient registry JSON (each entry pairs a public key with its attributes), and type the policy, for example (role=doctor AND dept=cardio) OR clearance>=4. Leave the KEM at ML-KEM-512 (Level 1) or pick a higher level, and set an output path or accept the default {input}.qsabe.

Click “Encrypt with Policy”. For the full secret-sharing flow, use the Authority, Issue, Seal, and Open tabs instead; the Inspect Policy tab dry-runs a policy without encrypting anything.

Open Deniable under the ADVANCED group in the left rail. The screen shows two tabs, Create and Open, and opens on Create. The panel is titled “Create Deniable Volume” with the tagline “Two passwords, two payloads, one file.”

Pick the real payload (revealed by the real password) and the decoy payload (revealed by the decoy password), then set the output file. Optionally add a recipient public key and turn on “Hybrid (KEM + password)” to combine a post-quantum KEM with the passwords.

Click “Create Volume”. You are prompted for two passwords (unless you use KEM-only mode); the output is indistinguishable from random, so no one can prove a hidden volume exists.

Open Timelock under the ADVANCED group in the left rail. The screen has Encrypt and Decrypt tabs and opens on Encrypt. The panel is titled “Lock File” with the note “Encrypt with time delay (RSW puzzle).”

Choose the file to time-lock with Browse, set an output path, and pick a Lock duration (the selector shows presets such as 1 hour). Optionally click Calibrate first so the puzzle is sized to this machine's speed.

Click “Time-Lock”. The file cannot be decrypted until that much sequential computation has elapsed; decrypting later solves the puzzle and takes roughly the chosen duration.

Open Keyfile under the ADVANCED group in the left rail. The screen stacks three sections: Key File (select or generate a 256-bit AES key), Encrypt (encrypt a file with the selected key), and Decrypt (decrypt a file that used symmetric key encryption).

In the Key File section, Browse to an existing 256-bit key file or click “Generate Key” to create a new random one. Then, in the Encrypt section, choose the file to encrypt and an optional output path.

Click “Encrypt” to produce a .qskf file. To reverse it, use the Decrypt section with the same key file. Keep the key file safe: anyone who holds it can decrypt your data.

Open Rekey (under Manage). Click Browse and choose the encrypted .qs file whose password you want to change.

Click Change Password. You are prompted for the current password, then the new password. Only the password wrapping is rewritten; the encrypted data is not touched.

The file is updated in place. The Equivalent command line panel shows the exact qnsqy rekey command.

Open Audit (under Manage). Click Load to read this device’s append-only audit log. Use Options to filter to security-relevant events only.

Click Verify to check the log’s tamper-evident hash chain. A broken chain means the log was altered.

Click Export to write the log out (CSV, JSON, syslog or CEF) for a SIEM.

Open Scanner (under Manage). Click Browse and pick a directory to scan for classical, non-quantum-safe cryptography.

Turn on Recursive scan to include subfolders, and pick a Report format (Text, JSON, and so on).

Click Start Scan. Findings appear in the results panel: GPG/PGP keys, X.509 certificates, SSH keys, PKCS#12, Java keystores, Age files and more, each with a post-quantum recommendation.

Open Migrate (under Manage). Click Browse to choose the directory to scan and migrate, and a separate backup directory for the original files.

Turn on Recursive scan to include subfolders. Leave Inventory my QNSQY files off unless you are cataloguing files you already encrypted.

Click Scan Directory to preview, then migrate the vulnerable files to the quantum-safe .qs format. The originals are copied to your backup directory first.

Open Policy (under Manage). Click Init Policy once to create the local policy file, then Show Policy to view the current settings.

Under Set Policy Value, pick a key (for example min_password_length) and enter a value (a number, true/false, an algorithm like ml-kem768, or none).

Click Set Value. The organization policy floor still applies on top of any local value.

Open Groups (under Manage). Type a Group Name and click Create to make a new recipient group.

To add a member, enter a Member Label, click Browse to pick that member’s public key file, then click Add Member.

Use List, Show, Remove and Delete to manage groups. Encrypt to a whole group later with --group.

Open Escrow (under Manage). Under Generate Escrow Keys, enter your Organization name and an output directory, then generate the escrow key pair. Store the private bundle offline.

To recover data, use Escrow Decrypt: pick the encrypted file, the escrow private key bundle, and an output file.

Click the matching action button. Escrow lets an organization recover a file when the individual key is lost.