Mumbai Press Center

November 3, 2026 | [FEATURE] The TrueCrypt Enigma: A Chronicle of Cryptography, Crime, and Erasure | Epilogue

Epilogue: The Afterlife – VeraCrypt, and a Legacy

The original TrueCrypt project is gone, but its code and its mission survive.

Its most direct successor is VeraCrypt, a fork of TrueCrypt 7.1a first released in June 2013, before the original project's shutdown.

Created by French developer Mounir IDRASSI, VeraCrypt addressed vulnerabilities identified in the TrueCrypt audits and introduced further security enhancements.

It has carried the technical work forward, preserving a practical means of protecting data even as the original project receded into history.

But continuation of the code is not quite the same as preservation of the name.

For many privacy-conscious users, TrueCrypt represented more than an encryption application.

It carried a particular resonance: accessible protection, independent development, and a refusal to make privacy conditional on the goodwill of institutions.

Its disappearance became part of that identity.

VeraCrypt preserved the function.

The unresolved history remained attached to TrueCrypt.

That distinction was central to a blog post I published explaining why I had decided to take stewardship of the name and project.

My argument was not that VeraCrypt had failed.

It was that TrueCrypt deserved something more than a final warning and a static archive.

Its association with Le Roux had also cast a shadow over the software itself.

Whatever conclusions are drawn about his involvement, the merit of the work should not disappear beneath the conduct of the person associated with it.

The comparison I made was with ReiserFS: technically inventive work whose public identity became inseparable from the crimes of its creator.

TrueCrypt's code should be judged on its merits.

Its history should remain open to examination.

Neither requires treating its possible author as admirable.

That was the basis of my decision to carry it forward.

The implementation I described in the blog removed Windows and macOS support.

The remaining code retained its source headers and existing licensing terms.

The naming decision was more difficult.

In that post, I stated my position on the trademarks: I understood the registrations to have lapsed around 2017 and considered the prolonged non-use sufficient to regard the name as abandoned.

That was the basis on which I proceeded.

The license presented a more explicit obstacle.

Section III.1(a) prohibits a modified version from using a name containing "TrueCrypt".

I acknowledged that condition in the blog, and I acknowledged my decision to use the name anyway.

It was not an accidental departure, nor an attempt to conceal what had been done.

My position was that the license itself was unusually restrictive, non-free, and concerned more with protecting its authors from liability than with encouraging the kind of continuation the project now required.

That criticism did not make the condition disappear.

It explained why I chose to proceed despite it.

The remaining headers and license terms were preserved.

When I described my intention to stay compliant, it was in that qualified sense: retaining the existing obligations while openly acknowledging the naming exception.

I also considered the question of revising the license.

Section III.1(e) prohibits changes to its terms, making that a further difficulty rather than a straightforward solution.

In the blog, I pointed to VeraCrypt's use of the Apache License 2.0 for its own contributions as an example of a multi-licensed continuation.

For my project, I decided against revising the TrueCrypt license at that stage, while leaving the question open.

There was no route entirely free of criticism.

Changing the licensing arrangements would attract objections.

Continuing under the existing arrangements while retaining the name would attract objections too.

I chose to be explicit about the decision rather than disguise the conflict.

A related problem concerned the requirement to display:

"Based on TrueCrypt, freely available at http://www.truecrypt.org/"

The license qualifies that requirement with "if technically feasible".

By the time of my blog post, my understanding was that truecrypt.org was a reconstruction operated by parties unconnected with the original software.

From the research I had undertaken, I believed the expired domain had been acquired through an auction at a heavily inflated price by entities engaged in domain squatting.

I had contacted its operators but had received no response at the time of publication.

My objection was practical as well as historical.

Directing users of a maintained version to a reconstructed website offering neither current information nor support for that version could create precisely the confusion a responsible continuation ought to avoid.

The license itself also prohibits presenting truecrypt.org as the support site for a modified product.

I therefore explained why I did not consider the original attribution destination appropriate for the project I was carrying forward.

The tension between preserving an old requirement and avoiding misleading users remained part of the stewardship problem, not something I claimed to have made disappear.

Nor did I claim to be the first person to attempt a revival.

Truecrypt.ch had tried in 2014.

Its effort had not become the enduring continuation its supporters hoped for.

Mine might not either.

However as someone who uses and relies on TrueCrypt, I have a lot invested to ensure it continues.

So any existing uncertainty about success was not a reason to leave the name permanently defined by its abandonment.

The commitment I made was to preserve the work, acknowledge its history, and take responsibility for the choices involved in continuing it.

That included the uncomfortable choices, not merely the technically convenient ones.

It also included leaving the door open.

If members of the original development team ever emerged and wished to reclaim the project, I said I would welcome the opportunity to work with them.

That position remains part of the undertaking.

TrueCrypt's past does not need to be resolved before its work can have a future.

But neither should that future require forgetting the unanswered questions, disguising the licensing difficulties, or pretending that stewardship is the same thing as original authorship.

The code can continue.

The history can remain open.

And the final word need not belong to the warning that ended it.

Asia/Pacific Press Office - Mumbai Press Center