Cofferly is a small Windows-friendly Rust desktop app for tracking money held for kids.
Parent Coffer Story unlock:
Unlocked wallet ledger:
Parent settings:
Cofferly starts with two neutral child wallets. Each wallet keeps a local ledger of deposits and deductions, similar to a handwritten allowance sheet:
- Starting balance
- Money added
- Money spent
- Description for each entry
- Date
- Automatic running balance
- Coffer Story parent unlock
- Printable ledgers
- Custom child wallet names
- Local encrypted data file
Latest release (recommended): Cofferly releases on GitHub
| Asset | What it is |
|---|---|
Cofferly-*-windows-x64.zip |
Portable app — unzip and run Cofferly.exe |
Cofferly-*-Setup.exe |
Windows installer (when published with the release) |
No account, no cloud — data stays on your PC as an encrypted vault.cofferly file.
cargo build --release
# → target\release\Cofferly.exe
.\scripts\package-windows.ps1 -Version 0.2.0
# → dist\Cofferly-0.2.0-windows-x64.zipCofferly opens to a Coffer Story screen so kids cannot add, remove, rename, or print entries without a parent unlocking the app first.
Cofferly generates a sequence of six distinct objects from a stable set of 30. Write the sequence down (or use a recovery card) and store it away from the computer, then confirm it by choosing the objects in order from the shuffled grid. Cofferly deliberately generates the story rather than allowing a human-chosen sequence.
There is no local bypass. If both the story and your recovery copy are lost, the encrypted ledger cannot be recovered. Treat the story like a house key you cannot re-cut.
The story is also the input used to encrypt the local data file. Six ordered, distinct objects from 30 provide 427,518,000 possible sequences (about 28.7 bits). This is a substantial improvement over a four-digit PIN, but it does not protect against someone watching the objects as they are entered.
Existing installations with a four-digit PIN show a clearly labeled Legacy PIN screen. After a successful PIN unlock, Cofferly enrolls a new Coffer Story (generate → write it down → confirm). The old PIN no longer works once migration finishes.
Cofferly starts with Child 1 and Child 2 so the public app does not include anyone's real names.
After unlocking parent mode, open Settings to rename the selected wallet, update its starting balance, add another child wallet, or delete a wallet. Wallet deletion uses a confirm/cancel step and keeps at least one wallet available.
Use Remove latest entry in Settings to undo the most recent ledger entry for the selected wallet. The app offers a short undo window before the next change.
Use Print this wallet to print the selected child's ledger, or Print all wallets to print every child wallet together.
Cofferly writes a temporary printable HTML file (in your OS temp folder) and opens it in your browser. Previous print files are cleaned up when the app starts.
The repository includes an Inno Setup script at installer/Cofferly.iss.
Build the release executable first:
cargo build --releaseThen open installer/Cofferly.iss in Inno Setup and compile the installer. The installer output is written to dist/.
Install Rust from rustup.rs, then run:
cargo runTo create a release build:
cargo build --releaseThe app stores data locally as vault.cofferly in your operating system's Cofferly app data folder.
Data files are encrypted at rest using the Coffer Story (Argon2id key derivation + XChaCha20-Poly1305 authenticated encryption). This protects against casual tampering with the ledger file.
Cofferly reads only its current encrypted data format. The custom filename accurately identifies an encrypted Cofferly vault; security does not depend on hiding the filename or format.
On the first launch after this filename change, Cofferly safely transitions an existing encrypted data.json:
- If
vault.cofferlyalready exists, Cofferly uses it and does not modify either file. - Otherwise, Cofferly validates that
data.jsonhas the current encrypted format. - It atomically creates
vault.cofferlyand verifies that every byte matches the source. - It keeps
data.jsonuntouched as a recovery backup.
After unlocking, verify every wallet and recent entry, close and reopen Cofferly, and verify the vault again. Only then should you archive or manually delete data.json. If verification fails, close Cofferly, move vault.cofferly aside, and keep the original data.json for recovery.
Plaintext and unsupported files are never converted or overwritten automatically.
The encryption key is derived once per unlock (envelope encryption); subsequent saves reuse a session data key so the UI does not stall on Argon2id for every transaction. Parent mode also locks automatically after a period of inactivity.
Derived keys and plaintext serialization/decryption buffers are zeroized when dropped. The app's goal is family-use privacy and tamper resistance, not absolute protection against a determined attacker who has the data file.
If cargo is not on PATH on Windows, add Rust's Cargo folder to PATH:
$env:Path += ";$env:USERPROFILE\.cargo\bin"
cargo runSee docs/RELEASE.md.
- Simple enough for a family to use without setup
- Local-first, no accounts or cloud service required
- Easy to open source and maintain
- Friendly interface for parents and kids
This is a maintainer-led family app. Contributions are welcome when they fit the project goals, but all changes must go through issues or pull requests and maintainer review.
See CONTRIBUTING.md before opening a pull request.
Repository protection recommendations are documented in docs/GITHUB_SETTINGS.md.
MIT