Pure Vault

Open a backup without handing it over.

A free, MIT-licensed desktop reader for personal-data exports. Old conversations, notes, and photos, readable on your own computer.

Build from source Request early access
Pure Vault's messages viewer with a fictional conversation called Weekend plans open, the backup's categories in a left rail, and its import health visible.
The messages viewer reading the app's bundled fictional sample. Every capture on this site shows fictional data, never a real archive.
Local prerelease Feature-complete and building locally. No public release has been produced, signed, notarized, uploaded, or pushed.
Verified on macOS ARM64 Source and race tests, vet, a 13 MB native build, a launch smoke, and a no-open-socket check passed on 2026-08-19.
Windows and Linux: build targets Portable source with CI configuration. No native-runtime claim is made for either platform yet.
MIT licensed MIT-licensed prerelease. No account, no paid tier, no telemetry.

Point it at the export you already have.

A file, a folder, or a ZIP. Formats are recognized from their contents, not their filenames, and one selection can produce several readable categories.

Messages are the flagship

Six sources, one shared conversation viewer. Threads, people, dates, replies, and attachment references survive the trip.

Telegram Desktop
result.json, its folder, or the export ZIP
Facebook Messenger
the export folder, message_N.json, or export ZIP
Instagram DMs
the same Meta thread shape, wherever the folder names moved
Android SMS and MMS
SMS Backup & Restore XML, alone or in its folder
WhatsApp
an exported chat transcript or its ZIP
Apple Messages
a copied chat.db or selected Messages folder, experimental

Notes

Markdown, plain text, HTML, Google Keep JSON, and Evernote ENEX.

Contacts

vCard, plus known Google Contacts and Outlook CSV shapes.

Calendars

ICS events and tasks, shown without inventing an infinite series.

Media

Local photo, video, and audio folders. Folders act as albums.

Bookmarks

Netscape bookmark HTML. Every address stays inert, copy-only text.

Files

Bounded previews for JSON, CSV, YAML, TOML, INI, and logs.

The full matrix, each adapter's limits, and every measured safety boundary live on the compatibility page.

Pure Vault's start screen: the headline Open a backup without handing it over, Open file and Open folder buttons, and a link to a fictional sample.
The start screen. Two open actions, a labeled fictional sample, and the local-only promise before anything else.

Reading, not restoring.

Each opened backup becomes its own workspace in process memory. Several can be open side by side without mixing sources.

  1. Choose a file or folder

    Native pickers are the only way to authorize a path. Selecting one file does not expose its siblings.

  2. See what was detected

    The recognized shape, item counts, warnings, and evidence tier are visible before you settle in to read.

  3. Read in familiar viewers

    Conversations, notes, contacts, events, albums, bookmarks, and files share one calm shell.

  4. Search what is open

    Search is local to the open workspace and is forgotten with it. Queries are never stored.

  5. Export or clear, explicitly

    Export writes a normalized JSON or CSV copy to a new file you choose. Clearing a workspace only forgets memory; the source is untouched either way.

It tells you how sure it is.

Compatibility evidence is a first-class feature here, not fine print. Every import names its adapter, its evidence tier, and what remains unknown.

Verified

Nobody has earned this yet

Reserved for adapters proven against an independently sourced corpus with exact record reconciliation, malformed and partial coverage, and native-platform proof. No adapter carries the label today, and it will not be handed out early.

Preview

Implemented, exercised on fictional fixtures

The documented shape is implemented and tested against fictional repository fixtures. Most portable formats sit here today. Vendor drift and real-export coverage remain open evidence.

Experimental

Private schemas, drift expected

Formats that are private or undocumented enough that breakage is expected. Apple Messages chat.db is the current example: readable, useful, and labeled with appropriate suspicion.

Parse health is a separate axis

Complete, partial, unsupported, or failed describes one parse attempt. A clean parse never upgrades an adapter's evidence tier.

And when an export does not say how much it skipped, Pure Vault reports the reconciliation as unknown. It is never assumed to be zero.

A detail of the workspace rail: parse result partial import with three parser notices, compatibility evidence reading Preview, and a note that skipped-item reconciliation is not independently known.
The workspace rail during a partial import of the fictional sample. Parse result, evidence tier, and unknown reconciliation, all in view.

Nothing leaves the process.

No account, no telemetry, no archive library, no background network service. The trust boundary is documented behavior, not a slogan.

Read-only by construction

Sources are opened read-only. ZIPs are validated and read in place, never extracted to disk, and directory access cannot escape the selected root.

Memory-only workspaces

Imported content and source paths live in process memory. Clear a workspace or quit and they are gone. What survives is your display preferences and, only if you switch it on, a short list of where past backups live: pointers and detection details, never content.

The interface sees pages, not your disk

The UI receives metadata and normalized pages, never arbitrary filesystem access. Media previews use opaque, process-local URLs confined to the selected root.

Imported content stays inert

HTML and Markdown from a backup cannot run scripts or load remote media. Bookmark addresses are copy-only text the app never opens on its own.

No calls home

No update ping, no CDN, no runtime-loaded font. Source Sans 3 ships inside the application, and the content security policy allows packaged resources only.

Exports are deliberate

Writing a normalized copy requires a native save dialog, targets a brand-new file, and can never overwrite a source or land inside one.

The repository documents the full model in its architecture and security policies. The short version for this site is on the privacy page.

What it will not do, on purpose.

Pure Vault refuses clearly instead of parsing badly. These are product decisions, not roadmap gaps.

  • Encrypted device backups. Not opened, not brute-forced.
  • Signal backups. Encrypted by design, and left that way.
  • Encrypted WhatsApp databases. crypt-format files are refused by name.
  • Time Machine volumes and disk images. Out of scope entirely.
  • Restoring to a device. This is a reader, not a migration tool.
  • Deleted-data recovery. No forensics, no undelete promises.
  • Anything needing a password or login. Vaults and live cloud accounts stay unsupported.
  • Fetching remote attachments. If it is not in your export, it is not fetched.

Build it from source.

Building requires access to the private source repository.

There is no public download yet, and this page will not pretend otherwise. The app targets macOS 11 or newer, Windows 10/11, and Linux; building from source uses free tools (Go 1.26 itself wants macOS 12 or newer on a Mac).

You need Go 1.26.6 or newer, a supported Node.js line (22.22.2 and up, 24.15.0 and up, or 26 and newer), and the free Wails v2 prerequisites for your operating system.

Run it in development

go install github.com/wailsapp/wails/v2/cmd/wails@v2.15.0
cd frontend
npm ci
cd ..
wails dev

The empty state includes a fully fictional sample, so you can inspect every viewer without selecting personal data.

Build the native application

wails build -clean

Linux builds need the WebKitGTK 4.1 development package and one extra tag:

wails build -clean -tags webkit2_41

Verify what you built

go test ./...
go test -race ./...
go vet ./...
cd frontend
npm run check
npm run test
npm run build

No build or test needs a cloud account. Wails renders through the operating system WebView, so there is no bundled Chromium.

Rather wait for a signed build? You can request early access and hear about it when one exists.

Questions, answered plainly.

Is it really offline?

Yes. There is no account, telemetry, update ping, CDN asset, or runtime-loaded font, and the app never fetches URLs found inside a backup. A no-open-socket check is part of the recorded macOS verification.

Is it free?

Yes. Pure Vault is MIT-licensed with no paid tier. Source access is private. Third-party licenses are summarized in the repository.

Can I trust an import to be complete?

Only as far as the evidence says, and the app says so itself. Every import shows its compatibility tier separately from its parse health, and a skipped-item count the export does not reveal is shown as unknown, never assumed to be zero. Keep your originals; Pure Vault reads them without changing them.

Which platforms work today?

macOS ARM64 has recorded local verification from 2026-08-19: tests, race tests, vet, a 13 MB native build, an ad-hoc signature check, a launch smoke, and a no-open-socket check. Windows and Linux are portable build targets with CI configuration and no native-runtime claim yet.

Can it open Signal, encrypted WhatsApp, or an encrypted iPhone backup?

No, deliberately. Encrypted device backups, Signal backups, encrypted WhatsApp databases, Time Machine volumes, restoration, and deleted-data recovery are outside the product's purpose. It refuses clearly instead of guessing.

Where does my data go when I quit?

Imported content and search queries live only in process memory and are released when workspaces are cleared or the app exits. Source paths follow the same rule unless you switch on the off-by-default Remember opened backups list, which stores locations and detection details (never content) and is deleted when turned off. That is a process-level promise, not cryptographic memory erasure: an operating system may retain bytes in allocator pages, swap, or crash artifacts.

Why is there no download button?

Because there is nothing to download yet. Pure Vault is a feature-complete local prerelease: no public release has been produced, signed, notarized, uploaded, or pushed. Building from source requires repository access. You can request early access for word of a signed build.

Is the name final?

No. Pure Vault is a working name and has not been trademark-cleared.