9 min read By NT²
Challenge–response, not bearer email
Tech
Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge.
Tech
Engineering deep dives into the architecture and implementation behind NT² Vault.
16 posts
8 min read By NT²
One unlocked vault per tab — by design
Tech
Opening the same vault in two browser tabs is normal. Letting both tabs write the same on-device SQLite file is not. NT² Vault elects one Writer and keeps every other unlocked tab as a follower.
7 min read By NT²
Metadata in SQLite, ciphertext in BlobStore
Tech
A vault needs to know which files belong to which items, how large they are, and how to unwrap their keys. It does not need those encrypted bytes sitting inside the relational database that answers those questions.
8 min read By NT²
FTS5 for titles; table scan when filters win
Tech
Local search is not one query shape. Free-text wants a full-text index on titles and search text. Category, trash, archive, and similar filters want ordinary table predicates. The product switches strategy so the UI never has to ship the whole vault into memory to feel searchable.
8 min read By NT²
Never load the whole vault into Svelte state
Tech
A local vault can hold thousands of structured items without becoming a giant in-memory array. The durable store stays in SQLite. The UI holds only a paged window of lightweight list rows, rendered through a virtual list.
10 min read By NT²
The account database must not become a password oracle
Tech
An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system.
9 min read By NT²
One sync hub for one vault identity
Tech
A vault does not need to enter a shared plaintext mailbox to sync. Its public cryptographic identity can name a dedicated edge coordinator that notifies replicas and points them to encrypted frames it cannot open.
9 min read By NT²
No password reset, by design
Tech
“Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk.
9 min read By NT²
Blind replica sync on the edge
Tech
Sync does not have to turn a local vault into a cloud database. The edge can identify an account, store opaque replica frames, and deliver updates without learning what those updates contain.
9 min read By NT²
Why our vault SQLite database lives in OPFS, not IndexedDB
Tech
SQLite wants a file. A privacy vault wants durable relational storage that stays fast as its item count, indexes, and encrypted attachments grow. Putting a SQLite virtual file system on IndexedDB can bridge those worlds, but it makes the bridge part of every database operation. For NT² Vault, the browser vault file belongs in the Origin Private File System.