Secure Vault - Full Stack project by Abhishek Patel

The story

Why it exists

I built Secure Vault, a self-hosted team vault where a team works in workspaces and projects and keeps both normal documents and secure documents. Secure documents, including .env files, are encrypted and decrypted only in the browser with keys unlocked by a vault password, so the server only ever stores ciphertext. It also has a free public demo that runs on Vercel with a Neon database.

A zero-knowledge, self-hosted team vault for docs and secrets. Secure documents and .env files are end-to-end encrypted in the browser (Argon2id, X25519, AES-256-GCM), with workspaces, role-based access control, version history, key rotation and an append-only audit log. Built with FastAPI and React.

What it does

The features that matter

Workspaces and teams with Owner, Admin, Manager, Member and custom roles
Fine-grained permissions for who can see, edit or open secure documents
End-to-end encrypted .env editor with reveal, copy and download
Version history for every document, with restore
Automatic key sharing for new teammates and key rotation when access is removed
Append-only audit log of sign-ins, views, edits and access changes

Under the hood

How it works

Step 1
React 19 and TypeScript frontend; a FastAPI (Python 3.12) backend with PostgreSQL
Step 2
Encryption runs in the browser: Argon2id, X25519 sealed boxes and AES-256-GCM
Step 3
Site, app and API are served from one address so cookies stay first-party
Step 4
Self-hosted with Docker Compose (Postgres, API, nginx), or as a demo on Vercel and Neon

A look at it

As it runs today

Built with

React.js
TypeScript
Python
FastAPI
PostgreSQL
Docker

libsodium and WebCrypto for cryptography, SQLAlchemy 2 with Alembic, Tailwind CSS v4 and shadcn/ui, a typed API client generated from OpenAPI.

Ask ABI about it

Up next