Zero-Knowledge Encrypted File Storage
A privacy-first file vault where you control your encryption keys. The server never sees your password, files, or filenames — all cryptography happens in your browser.
- 🔒 Zero-Knowledge Architecture — Server stores only encrypted blobs it cannot decrypt
- 🔑 Client-Side Encryption — All crypto happens in your browser using libsodium
- 📁 Encrypted Everything — File content, filenames, and MIME types are all encrypted
- 🤝 Secure File Sharing — Share files using X25519 envelope encryption
- 📱 TOTP Two-Factor Auth — MFA secrets encrypted client-side
- ☁️ Cloud Native — Deploys to AWS with one command
┌─────────────────────────────────────────────────────────────┐
│ YOUR BROWSER │
│ ┌───────────────────────────────────────────────────────┐ │
│ │ Password ──► PBKDF2 ──► KEK ──► Encrypts VaultKey │ │
│ │ VaultKey ──► Encrypts FileKeys, Private Key, MFA │ │
│ │ FileKey ──► Encrypts file content + metadata │ │
│ └───────────────────────────────────────────────────────┘ │
│ │ │
│ Only encrypted data leaves │
└────────────────────────────┼────────────────────────────────┘
▼
┌─────────────────────────────────────────────────────────────┐
│ SERVER (Blind) │
│ • Cannot see passwords (never sent) │
│ • Cannot decrypt files (no keys) │
│ • Cannot see filenames (encrypted) │
│ • Can only store & serve encrypted blobs │
└─────────────────────────────────────────────────────────────┘
| Layer | Technology |
|---|---|
| Frontend | Next.js 14, TypeScript, TailwindCSS, libsodium |
| Backend | FastAPI, Python 3.11, SQLAlchemy |
| Database | PostgreSQL (AWS RDS) / SQLite (local) |
| Storage | AWS S3 with server-side encryption |
| Infrastructure | AWS CDK, Lambda, API Gateway, CloudFront |
# Clone the repo
git clone https://github.com/yourusername/vault.git
cd vault
# Start backend
cd backend
python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python run.py
# Start frontend (new terminal)
cd frontend
npm install
npm run dev# Prerequisites: AWS CLI configured, Node.js 18+, Python 3.11+
# Install CDK globally
npm install -g aws-cdk
# Deploy everything
chmod +x scripts/deploy.sh
./scripts/deploy.shSee DEPLOYMENT.md for a full guide: clone, .env setup, frontend build, docker compose up, and cloudflared configuration.
Password (your secret)
│
├─► PBKDF2-SHA256 (100k iterations)
│ │
│ ▼
│ KEK (Key Encryption Key) ─── Lives in memory only
│ │
│ ├─► Encrypts VaultKey
│ ├─► Encrypts MFA Secret
│ └─► Encrypts Private Key
│
└─► VaultKey
│
└─► Encrypts FileKeys (one per file)
│
└─► Encrypts file content, name, type
| Purpose | Algorithm |
|---|---|
| Key Derivation | PBKDF2-SHA256 (100,000 iterations) |
| Symmetric Encryption | XChaCha20-Poly1305 (AEAD) |
| Key Exchange | X25519 (Curve25519) |
| Authentication | Zero-knowledge proof (hash comparison) |
| MFA | TOTP (RFC 6238) |
vault/
├── backend/ # FastAPI backend
│ ├── app/
│ │ ├── models/ # SQLAlchemy models
│ │ ├── routers/ # API endpoints
│ │ ├── schemas/ # Pydantic schemas
│ │ ├── services/ # Business logic
│ │ └── lambda_handler.py
│ └── requirements.txt
│
├── frontend/ # Next.js frontend
│ ├── src/
│ │ ├── components/ # React components
│ │ ├── context/ # Auth context
│ │ ├── lib/
│ │ │ ├── api.ts # API client
│ │ │ └── crypto/ # Cryptography modules
│ │ └── types/
│ └── package.json
│
├── infra/ # AWS CDK
│ ├── lib/
│ │ └── vault-stack.ts # Infrastructure code
│ └── package.json
│
└── scripts/ # Deployment scripts
├── deploy.sh
└── destroy.sh
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/auth/register |
Zero-knowledge registration |
| POST | /api/auth/login/challenge |
Get encrypted data for login |
| POST | /api/auth/login/verify |
Verify decryption proof |
| POST | /api/files/upload |
Upload encrypted file |
| GET | /api/files/ |
List encrypted files |
| GET | /api/files/{id} |
Download encrypted file |
| DELETE | /api/files/{id} |
Delete file |
| POST | /api/sharing/files/{id}/share |
Share file with user |
| GET | /api/sharing/shared-with-me |
List received shares |
| POST | /api/mfa/setup/init |
Initialize MFA setup |
| POST | /api/mfa/verify |
Verify MFA code |
| GET | /api/health |
Health check |
| Traditional Cloud Storage | SecureVault |
|---|---|
| Server has your encryption keys | You hold the only keys |
| Server can read your files | Server sees only random bytes |
| Data breach = your files exposed | Data breach = encrypted garbage |
| Subpoena = your data handed over | "We literally can't decrypt it" |
See SECUREVAULT_DOCUMENTATION.md for comprehensive technical documentation including:
- Detailed security architecture
- Complete API reference
- Database schema
- AWS infrastructure details
- Cryptographic implementation
DATABASE_URL=sqlite:///./vault.db
CORS_ORIGINS=http://localhost:3000NEXT_PUBLIC_API_URL=http://localhost:8000- File versioning
- Folder organization
- Desktop app (Electron/Tauri)
- Mobile app (React Native)
- Team/organization support
- Hardware key support (WebAuthn)
Contributions are welcome!
- Fork the repository
- Create your feature branch (
git checkout -b feature/amazing-feature) - Commit your changes (
git commit -m 'Add amazing feature') - Push to the branch (
git push origin feature/amazing-feature) - Open a Pull Request
This project is licensed under the MIT License - see the LICENSE file for details.
This software is provided for educational purposes. While designed with security best practices, it has not undergone a formal security audit. Use at your own risk for sensitive data.
Your files. Your keys. Your privacy.