Encryption

# Encrypt with interactive password prompt
memvid lock memory.mv2 --out memory.mv2e

Enter password: ••••••••••••••••
Confirm password: ••••••••••••••••

✓ Encrypted memory.mv2 → memory.mv2e
  Original size: 52.4 MB
  Encrypted size: 52.5 MB
  Cipher: AES-256-GCM

# For automation and CI/CD
echo "your-secure-password" | memvid lock memory.mv2 --password-stdin --out memory.mv2e

# From environment variable
echo "$MEMVID_PASSWORD" | memvid lock memory.mv2 --password-stdin --out memory.mv2e

# From file
cat /path/to/password-file | memvid lock memory.mv2 --password-stdin --out memory.mv2e

# Keep original file (default: deletes original)
memvid lock memory.mv2 --out memory.mv2e --keep-original

# Overwrite existing encrypted file
memvid lock memory.mv2 --out memory.mv2e --force

# JSON output for scripting
memvid lock memory.mv2 --out memory.mv2e --json

{
  "status": "success",
  "source": "memory.mv2",
  "destination": "memory.mv2e",
  "original_size": 54938189,
  "encrypted_size": 54938301,
  "cipher": "AES-256-GCM",
  "kdf": "Argon2id"
}

# Decrypt with interactive password prompt
memvid unlock memory.mv2e --out memory.mv2

Enter password: ••••••••••••••••

✓ Decrypted memory.mv2e → memory.mv2
  Size: 52.4 MB

# For automation
echo "your-secure-password" | memvid unlock memory.mv2e --password-stdin --out memory.mv2

# From environment variable
echo "$MEMVID_PASSWORD" | memvid unlock memory.mv2e --password-stdin --out memory.mv2

# Overwrite existing file
memvid unlock memory.mv2e --out memory.mv2 --force

# JSON output
memvid unlock memory.mv2e --out memory.mv2 --json

# This won't work directly
memvid find memory.mv2e --query "search"  # Error: Cannot read encrypted file

# Decrypt first
memvid unlock memory.mv2e --out memory.mv2
memvid find memory.mv2 --query "search"

# Re-encrypt when done
memvid lock memory.mv2 --out memory.mv2e

# 1. Decrypt
echo "$PASSWORD" | memvid unlock memory.mv2e --password-stdin --out memory.mv2

# 2. Make changes
memvid put memory.mv2 --input new-document.pdf

# 3. Re-encrypt
echo "$PASSWORD" | memvid lock memory.mv2 --password-stdin --out memory.mv2e

# 4. Original .mv2 is deleted (default behavior)

# Random characters (use password manager)
Kj#9mP$2xL@nQ5vR

# Passphrase (easier to remember)
correct-horse-battery-staple-42

# Generated (most secure)
openssl rand -base64 24
# → "X7kP2mN9qR3sT6vY8wA1bC4d"

# Set password in environment
export MEMVID_ENCRYPTION_KEY="your-secure-password"

# Use in scripts
echo "$MEMVID_ENCRYPTION_KEY" | memvid lock memory.mv2 --password-stdin --out memory.mv2e
echo "$MEMVID_ENCRYPTION_KEY" | memvid unlock memory.mv2e --password-stdin --out memory.mv2

name: Backup Memory
on:
  schedule:
    - cron: '0 0 * * *'  # Daily

jobs:
  backup:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Memvid
        run: curl -fsSL https://get.memvid.com | sh

      - name: Decrypt, update, re-encrypt
        env:
          MEMVID_PASSWORD: ${{ secrets.MEMVID_PASSWORD }}
        run: |
          echo "$MEMVID_PASSWORD" | memvid unlock memory.mv2e --password-stdin --out memory.mv2
          memvid put memory.mv2 --input ./new-data/
          echo "$MEMVID_PASSWORD" | memvid lock memory.mv2 --password-stdin --out memory.mv2e

      - name: Upload encrypted backup
        uses: actions/upload-artifact@v4
        with:
          name: encrypted-memory
          path: memory.mv2e

FROM memvid/cli:latest

# Password passed at runtime
ENV MEMVID_PASSWORD=""

COPY memory.mv2e /data/

CMD echo "$MEMVID_PASSWORD" | memvid unlock /data/memory.mv2e --password-stdin --out /data/memory.mv2 && \
    memvid find /data/memory.mv2 --query "$QUERY"

docker run -e MEMVID_PASSWORD="secret" -e QUERY="search term" myimage

# HR documents
memvid create hr.mv2
memvid put hr.mv2 --input employee-records/
memvid lock hr.mv2 --out hr.mv2e

# Medical records
memvid lock patient-notes.mv2 --out patient-notes.mv2e

# Financial data
memvid lock finances.mv2 --out finances.mv2e

# Create encrypted backup
memvid lock knowledge.mv2 --out backups/knowledge-$(date +%Y%m%d).mv2e --keep-original

# Store password securely (password manager, vault, etc.)

# Sender
memvid lock shared-docs.mv2 --out shared-docs.mv2e
# Send shared-docs.mv2e via email/cloud
# Send password via separate secure channel

# Recipient
memvid unlock shared-docs.mv2e --out shared-docs.mv2
memvid find shared-docs.mv2 --query "search"

# Encrypt at rest
memvid lock phi-data.mv2 --out phi-data.mv2e

# Log access
echo "$(date): Decrypting phi-data for user $USER" >> audit.log
memvid unlock phi-data.mv2e --out phi-data.mv2

# Re-encrypt after use
memvid lock phi-data.mv2 --out phi-data.mv2e
echo "$(date): Re-encrypted phi-data" >> audit.log

memvid unlock memory.mv2e --out memory.mv2
# Enter password: ••••••••
# Error: Decryption failed - incorrect password or corrupted file

memvid unlock corrupted.mv2e --out memory.mv2
# Error: Authentication failed - file may be corrupted or tampered with

memvid unlock memory.mv2e --out memory.mv2
# Error: memory.mv2 already exists. Use --force to overwrite.

# Solution
memvid unlock memory.mv2e --out memory.mv2 --force

# Generate secure password
openssl rand -base64 24

# Store in password manager
# Never commit passwords to version control

# Keep secure backup before encrypting
cp memory.mv2 /secure-backup-location/

# Then encrypt for distribution
memvid lock memory.mv2 --out memory.mv2e

# Decrypt with old password
echo "$OLD_PASSWORD" | memvid unlock memory.mv2e --password-stdin --out memory.mv2

# Re-encrypt with new password
echo "$NEW_PASSWORD" | memvid lock memory.mv2 --password-stdin --out memory.mv2e

# Encrypt
memvid lock memory.mv2 --out memory.mv2e

# Verify by decrypting to temp location
memvid unlock memory.mv2e --out /tmp/verify.mv2
memvid stats /tmp/verify.mv2  # Should match original
rm /tmp/verify.mv2