Problem
Hosted password managers ask for total trust: your secrets sit decryptable on someone else's server. One breach or insider turns every stored credential into a liability.
Approach
- Zero-knowledge design: encryption and decryption happen in the browser with WebCrypto. The server only ever stores ciphertext it cannot read.
- NestJS API with a narrow contract — store blob, fetch blob, rotate keys. No plaintext ever crosses the wire.
- Postgres + Prisma for the vault store, Redis for sessions and rate limiting on auth endpoints.
- Next.js client with explicit locked/unlocked states, so it's always obvious whether secrets are in memory.
Outcome
Users manage passwords without relying on a third-party server holding readable secrets — privacy holds even if the server is fully compromised.
Stack notes
TypeScript, Next.js, NestJS, Postgres, Prisma, Redis, Tailwind CSS. Threat model documented alongside the code: what the server sees, and what it can't.