SECURITY & CLOUD SYNC ARCHITECTURE

.XPANDER Configuration & .xblob Encryption

Securely encrypt your text snippets, formatted templates, and images on disk and across OneDrive, Dropbox, or Google Drive.

Secure Encryption of Your Text Snippets and Images

The text snippets and images you insert with triggers often contain confidential or sensitive information:

▸ Standard customer responses, physical addresses, and internal company procedures
▸ Templates containing personal or client-identifiable details
▸ Credentials or tokens (though a dedicated password manager is always recommended for passwords)

With encryption enabled in .XPANDER, your configuration file (config.toml) is stored as authenticated ciphertext. This also applies to all images and rich-formatted text that .XPANDER stores in .xblob sidecar files.

Encryption works seamlessly with cloud folders like OneDrive, Dropbox, or Google Drive—keeping your data unreadable to third parties while synchronizing .XPANDER across multiple computers.

How It Works

AES-256-GCM Authenticated Encryption

.XPANDER uses AES-256-GCM, the industry gold standard for authenticated encryption. "Authenticated" means the file is not merely unreadable to others—if anyone tampers with or modifies a single byte of the ciphertext, .XPANDER detects it immediately and refuses to load the altered file.

The Key Stays on Your PC (Windows Credential Manager)

Your 256-bit encryption key is stored inside Windows Credential Manager (under dotXPANDER/ConfigKey) on your local computer. It is never stored inside the cloud folder alongside your encrypted data.

Everything Is Encrypted (config.toml + .xblob)

Both your main configuration file and every sidecar file in blobs/*.xblob containing images and rich text rotate atomically between plaintext and XPNDR AES-256-GCM ciphertext.

Zero Traces of Plaintext Backups

When you enable encryption, .XPANDER uses an atomic write pipeline (.tmp → .bak → config.toml) and immediately scrubs legacy unencrypted backup files from disk.

How to Enable Encryption

1 Open Settings in .XPANDER (click the system tray icon).
2 Toggle on "Encrypt configuration file" and confirm with "Enable encryption".
3 Your One-Time Recovery Key is displayed once in a modal dialog. Click "Copy to clipboard" and save it in a safe place, such as your password manager.

Important: Encryption can only be enabled in the installed version of .XPANDER. The portable ZIP version does not support encryption because it leaves zero footprint in the Windows Registry or Credential Manager.

Synchronize Safely Across Multiple PCs

Many users run .XPANDER on both a work PC and a home PC and want the exact same snippets everywhere. By placing your configuration in a folder synced by OneDrive, Dropbox, or Google Drive with encryption enabled, neither your cloud provider nor anyone with access to the cloud folder can read your snippets.

First PC

1. Select a cloud-synced folder as your configuration location—either during installation or later in Settings → General.
1. Enable encryption and save your One-Time Recovery Key.

Next PC

2. Install .XPANDER and point it to the exact same cloud-synced folder.
2. On first launch, .XPANDER prompts for your recovery key because the new PC does not have the key in its local Credential Manager yet. Paste the recovery key and click OK.
2. The key is now saved in Windows Credential Manager on that PC. On every subsequent launch, .XPANDER unlocks your configuration automatically.

Best Practices for Cloud Synchronization

✓ Use the same recovery key across all PCs sharing the same cloud folder.
✓ Edit your snippets on one PC at a time, and let your cloud service finish syncing before opening Settings on another PC.
✓ .XPANDER saves atomically in multiple steps (.tmp → .bak → config.toml) so your file is never corrupted mid-sync. If the newest file cannot be read, .XPANDER automatically falls back to the latest encrypted backup.

The Recovery Key: Store It Safely

The One-Time Recovery Key is the only way to unlock your encrypted configuration on a new PC, after a fresh Windows installation, or if you reset your Windows user profile. Store it somewhere you can always find it, such as your password manager.

.XPANDER is 100% offline and has zero access to your key. Therefore, neither aiVOLUTION ApS nor anyone else can recover it for you. If you lose both your recovery key and the key in Windows Credential Manager, your encrypted configuration cannot be opened again.

Disabling Encryption

You can turn off encryption at any time in Settings. Your configuration and .xblob files are immediately converted back to standard unencrypted format (TOML), and the encryption key is deleted from Windows Credential Manager on that PC.

Your Privacy

.XPANDER runs 100% offline with zero telemetry. The application never transmits your snippets, images, or encryption keys anywhere. Synchronization happens exclusively through your own chosen cloud storage provider.

Encryption protects your files at rest on disk and in the cloud. While you are signed into your Windows user account, .XPANDER unlocks the files automatically using your personal Windows Credential Manager vault. If another user logs onto the same PC under a different Windows account, the files remain locked.

Encryption Frequently Asked Questions

What happens if I lose my recovery key?

As long as at least one of your PCs still has the key stored in its local Windows Credential Manager, .XPANDER will continue working normally on that PC. You can simply disable encryption in Settings and immediately enable it again to generate a brand-new recovery key. However, if you lose both the recovery key and access to all PCs with the key in Credential Manager, you will need to start fresh with a new configuration.

Do I have to use encryption if I only have one PC?

No, encryption is completely optional. It is strongly recommended if your configuration lives in a cloud-synced folder, or if your text snippets and images contain sensitive information.

Does encryption work in the portable version?

No. You must use the installed version of .XPANDER to enable configuration encryption.

Can I use different keys on my PCs?

All PCs sharing the same configuration file in a shared cloud folder must use the same key (via the recovery key). However, if you maintain separate configurations on separate PCs, each PC can have its own independent encryption key.

VERIFIED DISTRIBUTION · GITHUB RELEASES · WINGET · MS STORE v0.3.24

Windows 10 (1809+) & Windows 11 · No Admin/UAC Required

Download & Install .XPANDER

Choose your preferred deployment channel. Every binary is compiled natively for both x86_64 (Intel/AMD) and ARM64 (Qualcomm Snapdragon / Surface) and verified with SHA-256 checksums.

RECOMMENDED · NO ADMIN / UAC REQUIRED ✓ SHA-256 Verified

Per-User Setup Wizard

Installs cleanly to %LOCALAPPDATA%\Programs\aiVOLUTION\dotXPANDER without requiring Administrator elevation. Includes a custom cloud-sync folder wizard, optional Windows sign-in autostart, automatic running-instance upgrade detection, and downgrade protection.

Download Setup (x64)

dotXPANDER-x64-Setup.exe · Intel & AMD CPUs 6.38 MB

Download Setup (ARM64)

dotXPANDER-arm64-Setup.exe · Snapdragon & Surface Copilot+ 6.29 MB

View full release notes & assets on GitHub ↗

WINDOWS PACKAGE MANAGER

One-Line Terminal Installation

Winget automatically detects your CPU architecture and installs the matching native binary. To explicitly force the native ARM64 build on Snapdragon laptops, append the --architecture arm64 flag.

Standard installation (auto-detects x64 / ARM64):

winget install aiVOLUTION.dotXPANDER

Explicitly target native ARM64:

winget install --id aiVOLUTION.dotXPANDER --architecture arm64

Direct package identifier: aiVOLUTION.dotXPANDER. Ideal for developers, repeatable workstation setups, and automated provisioning scripts.

ZERO-REGISTRY PORTABLE & ENTERPRISE MDM

Portable ZIP Archive & Silent Deployment

Extract anywhere (including a USB drive or local tools folder). When launched without an installer registry key, .XPANDER automatically runs in Portable Mode, storing config.toml and blobs/ directly alongside dotxpander.exe with zero registry writes.

Download Portable ZIP (x64) dotXPANDER-x64-v0.3.24.zip Download Portable ZIP (ARM64) dotXPANDER-arm64-v0.3.24.zip

Enterprise / Silent Inno Setup Flags (MDM, Intune, Group Policy):

# Fully silent per-user install (no UI, no UAC prompt)
dotXPANDER-x64-Setup.exe /VERYSILENT /NORESTART /ALLUSERS=0

# Silent uninstall
"%LOCALAPPDATA%\Programs\aiVOLUTION\dotXPANDER\unins000.exe" /VERYSILENT /NORESTART

Note: /ALLUSERS=0 installs per-user to %LOCALAPPDATA% with zero UAC prompts.

🔒 Verify SHA-256 Cryptographic Checksums (checksums.txt)

Every GitHub Release automatically publishes SHA-256 hashes generated in CI. Verify your download in PowerShell with: Get-FileHash .\dotXPANDER-x64-Setup.exe -Algorithm SHA256

Asset Filename	SHA-256 Hash
dotXPANDER-arm64-v0.3.24.zip	ae88321d9c0cddf1bc92c2f3e4cd34df9ab3b3a93a81780c20fce678f00c36a6
dotXPANDER-x64-v0.3.24.zip	fd469796aa8378d2655558b9610f48f253fd120cf74e8a546d0de7874440c543
dotXPANDER-arm64-Setup.exe	8ac8629da3b763b7e8a1d82baae1a891504c9328cb7bb828b4797d8586acf8fe
dotXPANDER-arm64.exe	844ce831f4ce45f29012fd6dbc11d6cfac6c500caf1ff6a2da420697c1e16bc0
dotXPANDER-x64-Setup.exe	faf06d1e70684ffcf90ba4df80c853c5b75ae20475e033fb22ec922143170a97
dotXPANDER-x64.exe	9b0216c7652b9a78b4c0ee55ce847230a2efe802cbb95a2280e6d12dfc83cf64

Open raw checksums.txt on GitHub Releases ↗