Skip to content
BranchesTags

Repository files navigation

SecureSheet

Reversible Tokenization for Sensitive Excel Data, 100% Local

Replace sensitive data in Excel with format-preserving tokens, hand the encrypted file to AI for analysis with confidence, then restore the original data with a single password.

License .NET Avalonia Tests

SecureSheet Home

Read this in other languages

Language Link
简体中文 简体中文
繁體中文 繁體中文
日本語 日本語
한국어 한국어
Français Français
Español Español

Why SecureSheet?

When you need an AI to analyze an Excel sheet containing customer names, phone numbers, ID numbers, or other sensitive data, sending the raw file poses a serious data-security risk. SecureSheet replaces sensitive fields with format-consistent tokens (e.g. [[SS1:a1b2c3...]]) entirely on your machine. The encrypted file can then be safely handed to an AI for data analysis — the AI can recognize data types and run statistical aggregation, but never sees the real values. After analysis, restore the original data with your password.

Key Features

  • 100% local, zero upload — everything runs on your computer; files never leave your device
  • Reversible tokenization — sensitive data is replaced with format-preserving tokens; decrypt later with your password
  • Strong cryptography — Argon2id key derivation + AES-GCM Vault encryption + HKDF derivation + HMAC-SHA256 token generation
  • Automatic sensitive-column detection — multi-language keyword rules auto-identify 10 categories: names, phones, ID numbers, emails, bank accounts, and more
  • Defense in depth — never modifies source files (copy-on-write), atomic save (partial → rename), no plaintext in logs or temp files
  • 7-language UI — 简体中文, 繁體中文, English, 日本語, 한국어, Français, Español
  • Cross-platform — Windows x64, macOS arm64/x64

Quick Start

Requirements

  • Windows 10+ x64 or macOS 12+ (arm64 / x64)
  • .NET 10.0

Install & Run

# Clone the repository
git clone https://github.com/ro4/SecureSheet.git
cd SecureSheet

# Build
dotnet build

# Run
dotnet run --project src/SecureSheet.Desktop

Usage Flow

Select file → Auto-detect sensitive columns → Select columns to process → Set password → Start → Get encrypted file
  1. Drop or select an .xlsx file
  2. Auto-scan detects sensitive columns; tick the fields you want to encrypt
  3. Set a password of at least 6 characters (remember it — lost passwords cannot be recovered)
  4. Click process to generate the encrypted file
  5. Hand the encrypted file to an AI for analysis
  6. Use Restore mode to decrypt it with your password

Architecture

┌──────────────────────────────────────────┐
│  Desktop (Avalonia 12.1 + .NET 10.0)    │
│  MVVM + DI + 7-language i18n            │
├──────────────────────────────────────────┤
│  Application                            │
│  Encryption/Decryption orchestration    │
├──────────────┬───────────────────────────┤
│   Excel      │   Infrastructure         │
│   OpenXML    │   Privacy-safe logging   │
│   Inspection │   Portable settings      │
├──────────────┤                           │
│ Cryptography │                           │
│ Argon2id     │                           │
│ AES-GCM      │                           │
│ HKDF / HMAC  │                           │
├──────────────┴───────────────────────────┤
│  Domain (POCO models, errors, enums)    │
└──────────────────────────────────────────┘

Encryption Pipeline

Original Excel
  │
  ├─ Copy to .partial (source file untouched)
  ├─ Argon2id(pwd) → MasterKey
  ├─ AES-GCM(128-bit VaultKey, MasterKey) → WrappedKey
  ├─ HKDF(VaultKey) → TokenKey
  ├─ Stream-replace sensitive cells → Token (styles preserved)
  ├─ Clear formula cache + shared strings
  ├─ Encrypt Vault + write Custom XML Part
  ├─ OpenXML validation
  ├─ Atomic rename(.partial → .xlsx)
  └─ Zeroize keys (SecureZeroMemory)

Project Structure

SecureSheet/
├── src/
│   ├── SecureSheet.Domain/          # Domain models (no external deps)
│   ├── SecureSheet.Cryptography/    # Crypto primitives (BouncyCastle)
│   ├── SecureSheet.Excel/           # OpenXML operations layer
│   │   └── Inspection/              # Multi-language sensitive-header detection
│   ├── SecureSheet.Application/     # Business orchestration layer
│   ├── SecureSheet.Infrastructure/  # Logging, storage
│   └── SecureSheet.Desktop/         # Avalonia UI
│       ├── Localization/            # 7-language i18n system
│       ├── Resources/Strings/       # Language resource files
│       ├── Views/                   # XAML views
│       └── ViewModels/              # MVVM ViewModels
└── tests/
    ├── SecureSheet.Domain.Tests/
    ├── SecureSheet.Cryptography.Tests/
    ├── SecureSheet.Excel.Tests/
    ├── SecureSheet.Application.Tests/
    ├── SecureSheet.Infrastructure.Tests/
    └── SecureSheet.IntegrationTests/

Internationalization (i18n)

SecureSheet supports 7 languages; all user-facing text is localized:

Language Code Coverage
简体中文 zh-CN UI + error messages + sensitive-field labels
繁體中文 zh-TW UI + error messages + sensitive-field labels
English en-US UI + errors + category labels
日本語 ja-JP UI + error messages + category labels
한국어 ko-KR UI + error messages + category labels
Français fr-FR UI + errors + labels
Español es-ES UI + errors + labels

Language files live in src/SecureSheet.Desktop/Resources/Strings/ (JSON, freely extensible).

Sensitive-Header Detection Coverage

Detection keywords cover all 7 languages, e.g.:

  • Name: name / 姓名 / 名前 / 이름 / nom / nombre
  • Phone: mobile / 手机号 / 携帯番号 / 휴대폰번호 / portable / móvil
  • ID number: identity / 身份证号 / マイナンバー / 주민등록번호 / identité / identificación
  • ... 200+ keywords covering 10 sensitive categories

Development

Build Requirements

  • .NET 10.0 SDK
  • Windows x64 / macOS arm64 / macOS x64

Common Commands

# Build (warnings as errors)
dotnet build

# Run all tests (262)
dotnet test

# Run tests for one project
dotnet test tests/SecureSheet.Cryptography.Tests/

# Publish (self-contained single-file)
dotnet publish src/SecureSheet.Desktop -c Release -r win-x64 --self-contained

Adding a New Language

  1. Copy Resources/Strings/en-US.json to a new language file (e.g. de-DE.json)
  2. Translate every key
  3. Add the language code to the SupportedCultures array in LocalizationService.cs
  4. Add matching keywords in SensitiveHeaderDetector.cs
  5. Add the language option in SettingsView.axaml

Tests

SecureSheet follows strict test-driven development:

Test project Tests Coverage
Domain 1 Model integrity
Cryptography 62 Argon2id, AES-GCM, HKDF, HMAC
Excel 93 Sensitive detection (incl. multilingual), workbook checks
Application 1 Service integrity
Infrastructure 60 Privacy filtering, log rolling, settings storage
Integration 45 End-to-end encryption/decryption, leak prevention, cancel cleanup
Total 262 All passing, 0 warnings, 0 errors

Security Notes

  • Encryption strength: Argon2id (t=3, m=64MB, p=4) + AES-256-GCM
  • Source files are never modified (copy to .partial → process → atomic rename)
  • Sensitive plaintext never enters logs, temp files, or persistent storage
  • Passwords are never saved or transmitted
  • Everything runs locally; files never leave your device

License

MIT

Built with Avalonia 12, OpenXML SDK, BouncyCastle, and CommunityToolkit.Mvvm

About

Replace sensitive data in Excel with format-preserving tokens, hand the encrypted file to AI for analysis with confidence, then restore the original data with a single password.

Topics

encryptionexceltoolswindows

Resources

Readme
MIT license
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages