PacCrypt-Webapp/ROADMAP.md

Fully modular code for encryption libraries, ensure metadata is stored as encrypted hashs for PacShare, Revamp PacShares secure file send and pickup, and create a CLI and local application (Linux and Android).

Draft tree for webapp

\paccrypt-webapp/ \├── static/ \│ ├── audio/ \│ │ └── chomp.mp3 \│ ├── css/ \│ │ └── styles.css \│ ├── fonts/ \│ │ └── PressStart2P-Regular.ttf \│ ├── img/ \│ │ ├── Github_logo.png \│ │ ├── PacCrypt.png \│ │ ├── PacCrypt_W-Background.png \│ │ ├── PacCrypt_W-Backgroud_Name.png \│ │ ├── PacCrypt_W-Name.png \│ │ └── sitemap.png <-- Change img \│ └── js/ <-- Pending changes \│ ├── encryption.js \│ ├── fileops.js \│ ├── main.js \│ ├── pacman.js \│ └── ui.js \├── templates/ \│ ├── 403.html \│ ├── 404.html \│ ├── 500.html \│ ├── admin.html \│ ├── admin_login.html \│ ├── admin_settings.html \│ ├── admin_setup.html \│ ├── index.html \│ └── pickup.html \├── application_data/ <-- New \│ ├── scripts/ <-- New \│ │ ├── start_dev <-- Moved \│ │ ├── start_prod <-- Moved \│ │ ├── restart_dev <-- New \│ │ ├── restart_prod <-- New \│ │ └── stop <-- New \│ ├── settings.json <-- Moved \│ ├── requirements.txt <-- Moved \│ ├── admin_cred <-- Generated once admin is setup / Moved \│ └── admin_hash <-- Generated once admin is setup / Moved \├── paccrypt_algos/ <-- New \│ ├── aes_gcm.py <-- New \│ ├── aes_cbc.py <-- New \│ ├── xchacha.py <-- New \│ ├── rsa_hybrid.py <-- New \│ └── kyber_hybrid.py <-- New \├── pacshare/ <-- Generated at time of first PacShare upload, location customizable / New \│ ├── <file_id>pdf/jpeg/etc.paccrypt <-- Encrypted binary file / Moved \│ └── <file_id>meta.paccrypt <-- Encrypted metadata / Moved \├── README.md <-- Needs Updated \├── ROADMAP.md \├── LICENSE <-- New \└── app.py

Phase 0

[] Remove docker files (Dropping official docker support)

[] Update README.md to be current.

[x] Add roadmap.md to repo

[] Create /application_data/ folder (for server settings, admin login and creds)

[] Create scripts folder in /application_data/

[] Create /paccrypt_algos/ folder

[] Builder better start, stop and restart scripts both prod and dev (Universal)

[] Add a button in the admin panel to switch to and from prod and dev modes

Phase 1: app.py - Modular Python Web App

app.py Responsibilities

[] Flask app + routing

[] Handle: ⦁ /encrypt ⦁ /decrypt ⦁ /pickup/<file_id>

[] Receive: ⦁ File or text ⦁ pickup_password (required) ⦁ encryption_password (required) ⦁ encryption_mode [] Encrypt metadata using pickup password [] Encrypt file using encryption password [] Dynamically load correct engine via decrypted metadata [] Save .enc + .meta, return pickup link [] Update PacMan like mini game logic revamp "(LOW PRIORITY)" [] Update PacMan like mini game base revamp "(LOW PRIORITY)"

/paccrypt_algos/ - Modular Crypto Engines

[] Create folder + interface [] Remove basic cypher Implement engines: [] aes_gcm.py [] aes_cbc.py [] xchacha.py [] rsa_hybrid.py [] kyber_hybrid.py (Testing) [] Each must expose: def encrypt\_text(text, key, metadata): ... def decrypt\_text(ciphertext, key, metadata): ... def encrypt\_file(in\_path, out\_path, key, metadata): ... def decrypt\_file(in\_path, out\_path, key, metadata): ... def get\_name(): return "AES-GCM"

Phase 2: PacShare - Reimplementation

/encrypt Route Flow [] JS submits (PacShare "Form"): ⦁ File ⦁ pickup_password (for metadata) ⦁ encryption_password (for file) ⦁ encryption_mode ⦁ 2FA token code / Yubi/Passkey set up

[] Python logic: ⦁ Encrypt file using selected algo + encryption_password ⦁ Generate metadata dict: ⦁ filename, enc_mode, pickup_hash, timestamp, optional 2FA ⦁ Encrypt metadata using AES-GCM derived from pickup_password ⦁ Save .enc and .meta files ⦁ Generate random file_id ⦁ Return /pickup/<file_id> link

Both passwords are required. One reveals the mode + metadata, the other decrypts the file.

---

/pickup/<file_id> Route Flow

[] Prompt for pickup_password [] Decrypt .meta and validate hash [] Show original filename, prompt for encryption_password [] Load correct module, decrypt file [] Offer file download

Metadata Structure (Encrypted JSON)

"filename": "report.pdf", "enc\_mode": "aes\_gcm", "pickup\_hash": "<argon2>", "created\_at": "2025-08-05T18:00Z", "2fa\_seed": "base32string", // optional "yubi\_token\_hash": "sha256", // optional

Stored as .meta Encrypted with AES-GCM using key from pickup_password

---

Phase 3: External API Access (/api/*)

Endpoint Description

POST /api/encrypt Local-only file/text encryption (returns file/meta) POST /api/ps-send Upload + encrypt + return pickup link (JSON) POST /api/ps-pickup Provide pickup ID + passwords, return decrypted file POST /api/decrypt Decrypt local .enc + .meta bundle GET /api/version Return current version tag

These endpoints must receive both passwords. Encryption password is never saved.

---

Phase 4: CLI Tool (Offline and API Hybrid)

[] Create PacCrypt-CLI repo [] paccrypt-cli command [] Local encrypt/decrypt support [] Support: [] --share-api to change api address (in case user is self hosting PacCrypt-Webapp) ⦁ Default api from https://paccrypt.unnaturalll.dev/ [] --share to upload via /api/ps-send [] --pickup to download + decrypt via /api/ps-pickup Always require (Send + Pickup) [] --method (to define encryption type) [] --pickup-password [] --encryption-password Optional (Send + Pickup) [] 2FA Token ⦁ No Yubi or passkey support for API calls [] --help (Shows command usage) [] CLI PacMan like mini game "(LOW PRIORITY)"

Phase 5: Local GUI Applications

Linux (First)

[] PyQt6 or GTK [] Same features as the Webapp [] Support for PacShare through API calls ⦁ Default https://paccrypt.unnaturalll.dev/ ⦁ User changeable if the webapp is self hosted [] Text Encryption / Decryption mode [] Text Password [] Text input / output [] PS Mode selector [] PS File Uploader [] PS Pickup Password [] PS Encryption / Decryption password [] PS 2FA Token support ⦁ No Yubi/Passkey support for API calls [] PS error message if devices is offline or server can't be reached [] KDE Dolphin context integration (right-click → encrypt | decrypt | share - share opens the paccrypt gui with the file already staged)

Android

[] Kivy or BeeWare [] Same features as the Webapp [] Support for PacShare through API calls ⦁ Default https://paccrypt.unnaturalll.dev/ ⦁ User changeable if the webapp is self hosted [] Text Encryption / Decryption mode [] Text Password [] Text input / output [] PS Mode selector [] PS File Uploader [] PS Pickup Password [] PS Encryption / Decryption password [] PS 2FA Token support ⦁ No Yubi/Passkey support for API calls [] PS error message if devices is offline or server can't be reached

No Windows support for a application, only webapp, and maybe CLI support. Linux master race

---

PacShare File Format

pacshare/ ├── <file_id>pdf/jpeg/etc.paccrypt # Encrypted binary file └── <file_id>meta.paccrypt # Encrypted metadata

Development Order

0. [] Phase 0 Tasks
1. [] paccrypt_algos/ + aes_gcm.py
2. [] app.py routes: /encrypt, /pickup/
3. [] Add /decrypt route
4. [] Build metadata encryption helpers
5. [] Finish other engine modules
6. [] Build /api/* equivalents
7. [] Update README.md with all changed to the webapp.
8. [] Create a new installation guide.
9. [] Build CLI
10. [] Test CLI with --pickup + --share
11. [] Build GUI app on Linux
12. [] Test GUI app on Linux
13. [] Build GUI app on Android
14. [] Test GUI app on Android
15. [] Finilize all releases and push to main.
16. [] Create Wiki