VeilVoice

Irreversible voice de-identification — fully offline.

VeilVoice destroys the biometric voiceprint of a speaker — pitch, formants, timbre, micro-timing and the melody of an accent — so that neither software nor a human can re-identify them or reconstruct the original voice, while the words stay clean and transcribable.

ABOUT THIS PAGE

This is the JavaScript-free edition. It exists because refusing to run unknown code is a reasonable position, particularly on a site about not being identified, and “turn scripts on or leave” is a rude answer to it.

The main site is better, and here is the honest reason why. Two features need JavaScript and cannot be faked without it:

The hash verifier. Checking a download's SHA-256 inside your browser requires computation, and computation requires a script. On this page you verify from a terminal instead, which is no worse — arguably better, since sha256sum is a program you already trust.
The live repository panel — stars, latest release, the README rendered inline. Here you get plain links to GitHub.

If your concern is malicious script, note that the main site loads no third-party code at all: no CDN, no analytics, no web fonts, no tag manager. Every script is served from the same origin and is short enough to read in a few minutes: verify.js, theme.js, markdown.js, repo.js, legal.js. Read them, then decide. Or stay here — this page is complete, and it is not a lesser tier of information.

The colour schemes above work without JavaScript, using radio inputs and a CSS :has() selector. If your browser does not support it, you keep Tokyo Night and nothing else changes.

WHAT IT DOES

Anonymise a recording	wav, mp3, flac, ogg, m4a in — a clean WAV out, metadata stripped. Around 90× faster than real time.
Scramble live	Route the veiled voice into a virtual audio cable; every application on the machine receives it instead of you.
Encrypt at rest, by default	Every recording is sealed as it is written — X25519 + ML-KEM-768 hybrid, so one captured today is not readable by a quantum adversary tomorrow. Turning it off makes you read why first.
Lock the app	A separate, rate-limited password gates the desktop app. It stops someone who picks up your unlocked computer; it is not tamper-proof, and the unlock screen says so.
Strip metadata	Audio tags, image EXIF and GPS.
Rust library	Every crate is a normal dependency; the engine is allocation-free and callback-safe.

DOWNLOAD

Latest release — builds for Windows, macOS (Apple Silicon and Intel) and Linux.

Or build it; a fresh clone needs no secrets:

git clone https://github.com/tilas01/veilvoice
cd veilvoice
cargo build --release

SO YOU HAVE DOWNLOADED IT — NOW WHAT

Two programs are in the archive: veilvoice-gui, the desktop app, and veilvoice, the command line. They share one engine, so anything one can do the other can. Nothing installs a service, writes to a registry, or phones home — delete the folder and it is gone.

Give it a recording. wav, mp3, flac, ogg, m4a and friends. Around 90× faster than real time, so an hour of audio takes well under a minute.
```
veilvoice anonymise interview.mp3 -o clean.wav
```
The voiceprint is destroyed, the words are kept. Phase is discarded and resynthesised; pitch register, vocal-tract length and spectral tilt are each collapsed onto one canonical value, so a whole population of speakers lands on the same output and there is nothing left to invert.
It is encrypted before it reaches the disk. The result is sealed as it is written, so -o clean.wav produces clean.wav.veil. The WAV is built in memory and encrypted there — the plaintext never exists on disk, because a file that is written and then deleted cannot be reliably taken back on flash storage.
```
veilvoice decrypt clean.wav.veil -o clean.wav
```
Or scramble your microphone as you speak, routed into a virtual audio cable so every application on the machine receives that instead of you.
Check nothing else is listening. The monitor names what is holding your microphone and camera and warns the moment something starts.
Lock the app behind you. veilvoice lock set, or the lock tab in the desktop app.

The two passwords, and why there are two

The app lock	Decides whether VeilVoice opens at all. Argon2id verifier, rate limited: three attempts free, then a doubling wait.
The recording passphrase	Encrypts the files it writes. Argon2id at 256 MiB, or seal to a post-quantum hybrid public key instead.

They are deliberately different secrets. If one password did both, opening the app would be the same act as unsealing everything it had ever written — the opposite of what a lock is for. The two derivations are domain separated, so typing the same passphrase in both places still does not produce two copies of one value. Use two anyway: one guess that opens both defeats the point regardless of the maths.

The app lock is not tamper-proof, and cannot be. A program running on your computer has nowhere to hide a secret from that computer. It protects against casual access — the person who sits down at your unlocked session. If someone taking your disk is the threat, encrypt the whole volume.

VERIFY WHAT YOU DOWNLOADED

Do this. A download can be corrupted in transit or replaced entirely.

1. Check the hash

sha256sum -c SHA256SUMS --ignore-missing

On macOS: shasum -a 256 -c SHA256SUMS --ignore-missing. On Windows PowerShell: Get-FileHash .\veilvoice-*.zip -Algorithm SHA256 and compare by eye against SHA256SUMS.

2. Check the signature

gpg --import veilvoice-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS

The signature must name this exact key. “Good signature” from some other key means nothing at all:

8101 FB3B B28D 02FB 239E 0CDF 9CC1 C7E7 A9B5 833A

The key's user ID is exactly tilas01, with no e-mail address attached. Public key.

3. Rebuild it yourself — the strongest check

Releases are bit-for-bit reproducible. Build the tagged commit and compare:

git checkout v0.1.5
export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
cargo build --release --locked
sha256sum target/release/veilvoice

Signatures are detached and cover only the hash list — no binary is ever modified by signing, which is what lets it stay reproducible.

SECURITY

Why the transform cannot be undone

Phase discard	Every frame's measured phase is thrown away and a synthetic one generated. Phase encodes the exact waveform and micro-timing. Infinitely many waveforms share any magnitude spectrogram.
Many-to-one normalisation	Pitch register, vocal-tract length and spectral tilt are each collapsed onto one canonical value. A whole population maps to the same output, so there is nothing to invert.
CSPRNG modulation	The residual transform changes every frame from a ChaCha20 stream seeded by the OS CSPRNG, held in page-locked memory and zeroized on drop.

Encryption

Argon2id	Memory-hard password hashing (RFC 9106). Cost parameters travel with the file so old files still open.
X25519 + ML-KEM-768	Hybrid: an attacker must break both. Guards against harvest-now-decrypt-later.
XChaCha20-Poly1305	192-bit random nonces remove the counter-management failure mode entirely.
Authenticated header	The stored KDF cost cannot be downgraded to make cracking cheap.
Amnesic memory	Keys are page-locked out of swap, zeroized on drop, compared in constant time.
Sealed in memory	A recording that is going to be encrypted is never written to disk in the clear first — on flash storage, a plaintext file that is written and then deleted cannot be reliably taken back.

The app lock, and what it is worth

An Argon2id verifier	A password hash, stored and compared in constant time. It is not a key and encrypts nothing, because there is nothing local it could usefully encrypt.
Rate limited	Three attempts free, then the wait doubles from 5 s to a 15-minute cap. The count is persisted after every attempt, so restarting the app does not reset it.
A separate password	Different from the recording passphrase, and domain separated, so unlocking the app is not the same act as unsealing everything it has written.
Not tamper-proof	Anyone who can write to your files can delete the lock; anyone holding the disk can edit the counter, move the clock, or attack the hash offline. This protects against casual access, not against the disk. Encrypt the volume if that is the threat.

Libre

GPL-3.0-or-later. Run, study, change and redistribute it, including commercially; derivatives stay free.
No unsafe anywhere — every crate carries #![forbid(unsafe_code)].
No network code. CI fails the build if an HTTP client enters the dependency graph.
Reproducible builds: pinned toolchain, committed lockfile, path-remapped compilation.
Artwork generated from a readable script, not committed as a binary blob.
This page: no scripts, no cookies, no third-party requests of any kind.

WHAT IT WILL NOT DO

It does not hide what you said. Intelligibility is preserved on purpose; the words are in the output and can be transcribed. If the message itself is sensitive, encrypt it, or do not send it.

It does not fully remove a strong regional accent — the melody goes, the phonemes stay.
It does not sanitise background audio: room acoustics, other voices, a passing siren.
It does not hide your speaking rate or rhythm.
It does not help against an attacker already running code on your machine.
It does not clean filenames, filesystem timestamps, or the channel you send it over.
Page-locking keeps keys out of swap; it does not survive hibernation.

LICENCE, WARRANTY AND DISCLOSURE

VeilVoice is free software under the GNU General Public License v3 or later. You may run it for any purpose, study it, change it and redistribute it, including commercially. If you distribute a modified version you must publish your changes under the same licence. It is provided with absolutely no warranty.

This project was developed with AI assistance (Claude, by Anthropic) and has been reviewed and audited by tilas01. That is a maintainer audit: no external firm or independent researcher has reviewed this code. It is disclosed so you can judge how much to verify before relying on it — the source is published under the GPL precisely so that you can.

Using this website, the repository, the released binaries or any output they produce constitutes your binding agreement to these terms in full. There is no tick box on this page, because a tick box needs JavaScript; reading this section is the same agreement.

Full texts: disclaimer and liability waiver · the licence in plain English · GPL-3.0 full text

Privacy of this page. Static HTML on GitHub Pages. No cookies, no storage, no analytics, no fonts, no scripts, nothing fetched from anywhere else. Your theme choice is not even remembered — there is no JavaScript to remember it with, and that is the trade.