iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
ATLOCK’s author reports that corruption checks and fuzz tests rejected the mutations he tried, but his original sender-pinning test exposed a more important policy flaw: a mismatched sender key triggered a warning and decryption still proceeded. He later said the behavior had been changed to fail closed unless the user explicitly overrides it. These are the developer’s own results and follow-up claims—not an independent security audit or verified test of a publicly inspectable v5 release.
What the ATLOCK v5 self-test says—and what it does not
In an October 1, 2026 DEV Community post, Akhouri Anmol Kumar described testing ATLOCK, his encryption software. The post presented v4 as public and v5 as built but unreleased at that time. Its findings therefore describe the author’s tests and the state he reported in that post; they do not establish v5’s current release status, independently verify its implementation, or show that the reported later fix is in a public build. Read the author’s post and discussion.
The distinction at the heart of the post is between detecting damaged data and enforcing a sender policy. A file can pass integrity checks—or be rejected when altered—while the software still makes a questionable decision about whether to decrypt it after a sender-key mismatch.
What the author reports testing
Kumar reported 33 of 33 built-in checks passing. For corruption handling, he said the test rejected 200 random single-bit flips, five truncation cut points, and wrong-password attempts that raised AtlockAuthError. He reported zero silent corruption and zero unexpected crashes in the bit-flip test.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
He also described a fuzz run covering 300 container mutations, 100 garbage shares, and 60 junk imports, with no crashes or silent corruption reported. Those results are useful evidence about the specific inputs and environment he exercised. They are not proof that every malformed input, cryptographic edge case, or attack class is handled safely.
Public-key and recovery scenarios
In the author’s public-key test, Bob decrypted a file encrypted for him by Alice and verified its signature; Alice could not open a file encrypted for Bob. The post also says a changed byte was rejected and an edited signed file failed signature verification. For recovery, Kumar reported that each of the ten possible combinations of three shares out of five rebuilt the key, while two shares were refused.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
These are reported outcomes, not independent validation of the key-management design or the code. The article does not establish how the tests were implemented or independently reproduced.
Free tools Windows power users keep installed
One-click scans. No signup required.
The sender-pinning problem was about policy, not damaged ciphertext
Sender pinning means the recipient supplies an expected public key for the sender and the software checks the file’s signer against it. In the original test described by Kumar, supplying a mismatched expected_sender_pub returned signed: true and signer_matches: false, yet the file still decrypted. The application displayed a warning: “The app shows WARNING: this is NOT the sender key you pasted!, but it does not stop.”
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That behavior detects a mismatch but leaves the choice to proceed implicit: a user may interpret the warning as a hard stop, even though decryption continues. In the post’s discussion, Kumar said he found that an unsigned file also decrypted when a sender was pinned. He later reported changing v5 to fail closed with a dedicated exception and require an explicit override to decrypt anyway.
The fail-closed approach is a clearer default: when the user asks to accept only a particular sender, a mismatch or absent signature should prevent decryption unless the user deliberately chooses otherwise. However, the available account is the author’s report of a change; it does not verify that the fix appears in a released or publicly inspectable build.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reported performance and v4-to-v5 changes
The post’s comparison describes a substantial redesign. The figures and feature descriptions below are claims in Kumar’s article, not independently verified implementation facts. The performance measurements are author-reported tests from 2026; the post does not provide independently replicated benchmarks or enough methodology to treat them as general performance guarantees.
Recommended Free Tools
| Area | ATLOCK v4, as described in the post | ATLOCK v5, as described in the post |
|---|---|---|
| Code size | 3,074 lines; 23 classes | 8,432 lines; 55 classes |
| Encryption and password derivation | Fernet (AES-128-CBC plus HMAC); PBKDF2-SHA256 at 200,000 iterations | Chunked AES-256-GCM; Argon2id |
| Additional capabilities | Not stated in the comparison | X25519 and Ed25519 for public-key file sharing; Shamir 3-of-5 recovery; TOTP and FIDO2 hardware keys; built-in self-test |
For a 5 MB file, Kumar reported sealing in 0.77 seconds, opening in 0.63 seconds, and container overhead of 134 bytes. He reported Argon2id taking 0.16 seconds at 64 MiB and t=3, and 0.45 seconds at 128 MiB and t=4; the v4 PBKDF2 setting of 200,000 iterations took 0.05 seconds in his test. The post does not establish that these timings will hold on other hardware or configurations. In particular, the two Argon2id timings use different memory and time parameters, so they should not be read as a direct comparison of equivalent settings.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Important limits of the testing
Kumar said the tests ran on Linux even though ATLOCK is Windows-first. He explicitly did not test the GUI, Windows Hello, DPAPI behavior, BitLocker checks, camera or intruder capture, the startup watchdog, or FIDO2 with a real hardware key. Passing the reported Linux checks therefore says little about whether those Windows-specific features work as intended.
The post also relays a limitation from the project documentation: “A pure-Python tool cannot stop an attacker who is already running code as you, and secure-delete can’t be guaranteed on SSDs.” This is a meaningful boundary for any local security tool: encryption does not protect files from an attacker who can already act as the logged-in user, and deleting a file through software cannot guarantee that all copies of its data have been erased from solid-state storage.
The article mentions Bandit findings: one high item for SHA-1 in a Have I Been Pwned password-check flow and three medium urlopen findings. Kumar said only the first five hash characters are sent to the API and described that use as intentional; he also noted URL schemes should be pinned in the final release. These statements report the author’s account of the scan and its interpretation, rather than a separate security assessment.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow to read the results before trusting real files
- Give the results their proper weight. The post is a developer’s account of tests on his own software, not an independent audit or a reproduced test report.
- Separate integrity from trust decisions. Rejecting altered bytes is not the same as enforcing the recipient’s expected-sender policy. The original sender-pinning behavior is the clearest issue described.
- Do not infer Windows readiness from Linux tests. Several platform-specific protections and hardware paths were explicitly outside the test scope.
- Treat v5 status cautiously. The post said v5 was built but unreleased on October 1, 2026. Later release status and the reported fix are not established by the sources here.
- Do not treat feature lists as proof. Naming modern algorithms or recovery mechanisms does not, by itself, demonstrate correct implementation, safe defaults, or protection against every threat.
The post gives a useful example of why security testing should challenge both cryptographic integrity and user-facing policy. Its corruption results are encouraging within the limits of the reported tests; the sender-pinning behavior shows why a warning is not equivalent to enforcement. Anyone considering real files would need independent, reproducible evidence for the build and platform they intend to use, especially for the sender-pinning fix and the Windows-specific features.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
