Cubby

Cubby is a self-hosted password manager — a Bitwarden replacement with a web dashboard and a Firefox extension. The constraint that shapes every decision in it: the server never sees anything it could decrypt. Your master password and vault keys do not leave the client.

That is easy to claim and easy to get subtly wrong, so it is asserted by a test that talks to a live Postgres, registers a user, creates an item, and fails if any row holds anything but ciphertext. The property is enforced by CI rather than by my good intentions.

Where the crypto lives

Key derivation happens in the browser. The symmetric key stays in memory only — reload the page and you get the unlock screen back, master password required. The API deals exclusively in opaque blobs; it can tell you that an item changed and when, never what it says.

Sharing without cheating

Shared vaults are where zero-knowledge designs usually quietly compromise. Cubby gives every user an RSA key-pair, with the private key wrapped under their own symmetric key. A shared vault has its own key, delivered to each member encrypted to that member's public key. Invite by email, accept, and everyone can read and edit — while the server still holds nothing but ciphertext and a set of per-member wrapped keys it cannot open.

The rest of it

Revision-based delta sync against an encrypted local cache, so a client fetches what changed rather than the whole vault. Folders with encrypted names. Live TOTP codes. A configurable generator with look-alike exclusion. Client-side Bitwarden JSON import — decrypted, re-encrypted and uploaded without the plaintext touching the wire. Account recovery via a one-time key issued at signup, because "we can reset it for you" is precisely what a zero-knowledge system cannot offer.

Running it

One docker compose up brings up Postgres, the API, and a Caddy proxy handling auto-TLS and routing, plus a scheduled pg_dump backup with retention. The Firefox extension is built with WXT and is the piece still in progress.