https://blog.nt2.me/categories/tech Engineering deep dives into the architecture and implementation behind NT² Vault. en Wed, 02 Sep 2026 00:00:00 GMT https://blog.nt2.me/key-did-challenge-response-auth https://blog.nt2.me/key-did-challenge-response-auth Wed, 02 Sep 2026 00:00:00 GMT Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge. NT² authentication identity cryptography did security privacy cloud zero-knowledge https://blog.nt2.me/single-writer-multi-tab-vault https://blog.nt2.me/single-writer-multi-tab-vault Sat, 29 Aug 2026 00:00:00 GMT Opening the same vault in two browser tabs is normal. Letting both tabs write the same on-device SQLite file is not. NT² Vault elects one Writer and keeps every other unlocked tab as a follower. NT² architecture multi-tab local-first pwa sqlite broadcastchannel web-locks concurrency https://blog.nt2.me/attachment-ciphertext-outside-sqlite https://blog.nt2.me/attachment-ciphertext-outside-sqlite Wed, 26 Aug 2026 00:00:00 GMT A vault needs to know which files belong to which items, how large they are, and how to unwrap their keys. It does not need those encrypted bytes sitting inside the relational database that answers those questions. NT² attachments sqlite blobstore opfs envelope-encryption local-first aes-gcm chunking https://blog.nt2.me/fts5-vs-table-scan-in-the-vault https://blog.nt2.me/fts5-vs-table-scan-in-the-vault Sat, 22 Aug 2026 00:00:00 GMT Local search is not one query shape. Free-text wants a full-text index on titles and search text. Category, trash, archive, and similar filters want ordinary table predicates. The product switches strategy so the UI never has to ship the whole vault into memory to feel searchable. NT² architecture local-first sqlite fts5 search performance pwa https://blog.nt2.me/paged-list-not-full-table-load https://blog.nt2.me/paged-list-not-full-table-load Wed, 19 Aug 2026 00:00:00 GMT A local vault can hold thousands of structured items without becoming a giant in-memory array. The durable store stays in SQLite. The UI holds only a paged window of lightweight list rows, rendered through a virtual list. NT² architecture local-first sqlite svelte performance virtual-list pagination pwa https://blog.nt2.me/no-password-oracle-in-d1 https://blog.nt2.me/no-password-oracle-in-d1 Sat, 15 Aug 2026 00:00:00 GMT An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system. NT² architecture security privacy zero-knowledge edge cloudflare d1 authentication https://blog.nt2.me/vault-durable-object-per-key-did https://blog.nt2.me/vault-durable-object-per-key-did Wed, 12 Aug 2026 00:00:00 GMT A vault does not need to enter a shared plaintext mailbox to sync. Its public cryptographic identity can name a dedicated edge coordinator that notifies replicas and points them to encrypted frames it cannot open. NT² architecture sync privacy durable-objects key-did edge https://blog.nt2.me/no-password-reset-by-design https://blog.nt2.me/no-password-reset-by-design Sat, 08 Aug 2026 00:00:00 GMT “Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk. NT² security recovery zero-knowledge trust local-first https://blog.nt2.me/blind-replica-sync-on-the-edge https://blog.nt2.me/blind-replica-sync-on-the-edge Wed, 05 Aug 2026 00:00:00 GMT Sync does not have to turn a local vault into a cloud database. The edge can identify an account, store opaque replica frames, and deliver updates without learning what those updates contain. NT² architecture sync privacy local-first zero-knowledge edge https://blog.nt2.me/opfs-not-indexeddb-for-vault-sqlite https://blog.nt2.me/opfs-not-indexeddb-for-vault-sqlite Sat, 01 Aug 2026 00:00:00 GMT SQLite wants a file. A privacy vault wants durable relational storage that stays fast as its item count, indexes, and encrypted attachments grow. Putting a SQLite virtual file system on IndexedDB can bridge those worlds, but it makes the bridge part of every database operation. For NT² Vault, the browser vault file belongs in the Origin Private File System. NT² opfs indexeddb sqlite wasm wa-sqlite local-first pwa browser-storage https://blog.nt2.me/unlock-local-auth-cloud https://blog.nt2.me/unlock-local-auth-cloud Wed, 29 Jul 2026 00:00:00 GMT One screen can make two security events look like a single login. We keep them separate because opening encrypted data and proving an identity to a server are different jobs with different risks. NT² authentication local-first privacy security cryptography cloud https://blog.nt2.me/envelope-encryption-cek-per-object https://blog.nt2.me/envelope-encryption-cek-per-object Sat, 25 Jul 2026 00:00:00 GMT A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys. NT² envelope-encryption aes-gcm cryptography local-first attachments opfs security https://blog.nt2.me/kdf-salt-stays-on-device https://blog.nt2.me/kdf-salt-stays-on-device Thu, 23 Jul 2026 00:00:00 GMT A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device. NT² architecture crypto security local-first zero-knowledge web-crypto pbkdf2 key-derivation https://blog.nt2.me/one-person-ai-coding-agent-product-lifecycle https://blog.nt2.me/one-person-ai-coding-agent-product-lifecycle Mon, 20 Jul 2026 00:00:00 GMT The useful question is not whether an AI agent can write code. It is how to give agents enough context and autonomy to move quickly while keeping product decisions, security boundaries, releases, and customer-facing actions under explicit human control. NT² ai-agents human-in-the-loop spec-driven-development tdd devops security product-development https://blog.nt2.me/why-pwa-local-first-zero-server-vault https://blog.nt2.me/why-pwa-local-first-zero-server-vault Thu, 09 Jul 2026 00:00:00 GMT In the era of massive cloud-first applications, we often overlook a powerful alternative: the Progressive Web App (PWA). Why maintain a heavy, expensive, and potentially vulnerable server infrastructure when the modern browser is capable of running a full-featured, secure, and high-performance application entirely on the user's device? NT² architecture pwa privacy security local-first zero-knowledge web-crypto sqlite wasm opfs https://blog.nt2.me/threshold-vault-key-did-self-sovereign-identity https://blog.nt2.me/threshold-vault-key-did-self-sovereign-identity Tue, 30 Jun 2026 00:00:00 GMT Self-sovereign identity sounds abstract. In NT², the practical version is simpler: your vault can prove itself, recover without a help desk, and share under your control while NT² stays blind. NT² trust identity