https://blog.nt2.me/ Marketing stories about receiving, storing, and sharing sensitive assets with NT2 Vault (NT²). en Sat, 03 Oct 2026 00:00:00 GMT https://blog.nt2.me/vault-meta-as-section-kv https://blog.nt2.me/vault-meta-as-section-kv Sat, 03 Oct 2026 00:00:00 GMT Salt, Key DID public material, sync cursors, and onboarding prefs are not one fat SQL row. They live as named vault profile sections—so backup, sync, and unlock can each touch only what they need. NT² architecture sqlite vault-meta local-first backup sync zero-knowledge pwa https://blog.nt2.me/birth-certificate-and-insurance https://blog.nt2.me/birth-certificate-and-insurance Fri, 02 Oct 2026 00:00:00 GMT A new baby brings joy, exhaustion, and an unexpected amount of paperwork. NT² store family document https://blog.nt2.me/incremental-vault-schema-migration https://blog.nt2.me/incremental-vault-schema-migration Wed, 30 Sep 2026 00:00:00 GMT A local vault is a real SQLite database on your device. When the product ships schema v60, launch-era vaults must upgrade in place—not force a wipe because the CREATE statement changed in the source tree. NT² architecture sqlite schema-migration local-first opfs pwa data-durability https://blog.nt2.me/accountant-asks-for-documents https://blog.nt2.me/accountant-asks-for-documents Tue, 29 Sep 2026 00:00:00 GMT Every year, the same request arrives: bank statement, insurance proof, ID, receipts, and the document you swear you saved last April. NT² share document finance https://blog.nt2.me/password-verifier-fail-closed https://blog.nt2.me/password-verifier-fail-closed Sat, 26 Sep 2026 00:00:00 GMT Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest. NT² architecture crypto security local-first zero-knowledge web-crypto aes-gcm unlock https://blog.nt2.me/moving-abroad-admin-stack https://blog.nt2.me/moving-abroad-admin-stack Fri, 25 Sep 2026 00:00:00 GMT A new country comes with a new set of numbers: visa, residence card, bank account, tax ID, insurance, landlord forms, and appointment PDFs. NT² store travel document https://blog.nt2.me/cbf-payload-blobs-at-rest https://blog.nt2.me/cbf-payload-blobs-at-rest Wed, 23 Sep 2026 00:00:00 GMT A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader. NT² cryptography aes-gcm cbf local-first zero-knowledge envelope-encryption security https://blog.nt2.me/hardware-wallet-setup-day https://blog.nt2.me/hardware-wallet-setup-day Tue, 22 Sep 2026 00:00:00 GMT You bought the hardware wallet for safety. Setup day is when that safety either becomes a habit or turns into another note you hope you never lose. NT² store crypto https://blog.nt2.me/crypto-keys-must-not-survive-refresh https://blog.nt2.me/crypto-keys-must-not-survive-refresh Sat, 19 Sep 2026 00:00:00 GMT Encryption at rest is incomplete if the decrypted key handle outlives the unlocked session. NT² treats auto-lock as memory hygiene: non-extractable CryptoKeys, in-memory only, cleared on idle, refresh, and tab close. NT² web-crypto security crypto session auto-lock local-first pwa zero-knowledge https://blog.nt2.me/e2e-chat-is-not-a-vault https://blog.nt2.me/e2e-chat-is-not-a-vault Fri, 18 Sep 2026 00:00:00 GMT Signal can protect a message on the way to someone else. It does not turn the thread into structured storage. NT² share privacy comparison https://blog.nt2.me/sqlite-in-a-web-worker https://blog.nt2.me/sqlite-in-a-web-worker Wed, 16 Sep 2026 00:00:00 GMT A local-first vault needs a real relational engine on device. Putting that engine on the UI thread makes every page query compete with paint and input. NT² Vault runs SQLite in a Web Worker, behind typed messages and a single lock chain, so the list can stay responsive while the database stays honest. NT² web-worker sqlite wasm wa-sqlite opfs local-first pwa concurrency https://blog.nt2.me/already-local-first-missing-structure https://blog.nt2.me/already-local-first-missing-structure Tue, 15 Sep 2026 00:00:00 GMT If you already keep secrets in a local database, you may not need convincing about the cloud. You may need better structure. NT² migration store local-first https://blog.nt2.me/selective-ssi-not-a-did-wallet https://blog.nt2.me/selective-ssi-not-a-did-wallet Sat, 12 Sep 2026 00:00:00 GMT Self-sovereign identity is useful when you take the parts that fit a zero-knowledge vault—and refuse the parts that turn the product into a general DID wallet. NT² identity did share architecture privacy zero-knowledge security cryptography https://blog.nt2.me/where-do-mnemonics-go https://blog.nt2.me/where-do-mnemonics-go Fri, 11 Sep 2026 00:00:00 GMT A seed phrase does not have a login form. That small fact explains why some assets need a different kind of vault. NT² migration crypto store https://blog.nt2.me/blind-share-relay-local-inbox https://blog.nt2.me/blind-share-relay-local-inbox Wed, 09 Sep 2026 00:00:00 GMT A cloud can help deliver sealed packages without becoming the place where pending shares live as readable mail. Relay indexes ciphertext. Inbox stays on the device. NT² share inbox architecture privacy zero-knowledge edge local-first https://blog.nt2.me/outgrew-apple-notes https://blog.nt2.me/outgrew-apple-notes Tue, 08 Sep 2026 00:00:00 GMT Apple Notes was perfect for grocery lists, travel ideas, and quick reminders. Then it became the place for passport numbers, seed phrases, and bank details. NT² migration store privacy https://blog.nt2.me/share-passphrase-is-not-master-password https://blog.nt2.me/share-passphrase-is-not-master-password Sat, 05 Sep 2026 00:00:00 GMT A share that opens with the same secret that unlocks the vault is not a handoff. It is a remote unlock of everything. NT² keeps those boundaries apart. NT² share cryptography security privacy zero-knowledge aes-gcm identity https://blog.nt2.me/your-data-your-jurisdiction https://blog.nt2.me/your-data-your-jurisdiction Fri, 04 Sep 2026 00:00:00 GMT Where data lives shapes who can touch it, process it, subpoena it, lose it, or monetize it. NT² trust privacy local-first https://blog.nt2.me/key-did-challenge-response-auth https://blog.nt2.me/key-did-challenge-response-auth Wed, 02 Sep 2026 00:00:00 GMT Cloud services often treat an email inbox as the root of an account. An encrypted vault needs a different proof: control of a signing key, shown by answering a one-time challenge. NT² authentication identity cryptography did security privacy cloud zero-knowledge https://blog.nt2.me/escape-hatch-not-lock-in https://blog.nt2.me/escape-hatch-not-lock-in Tue, 01 Sep 2026 00:00:00 GMT A vault that protects your data should not trap your data. Backup and export are part of the trust model, not an afterthought. NT² trust backup migration https://blog.nt2.me/single-writer-multi-tab-vault https://blog.nt2.me/single-writer-multi-tab-vault Sat, 29 Aug 2026 00:00:00 GMT Opening the same vault in two browser tabs is normal. Letting both tabs write the same on-device SQLite file is not. NT² Vault elects one Writer and keeps every other unlocked tab as a follower. NT² architecture multi-tab local-first pwa sqlite broadcastchannel web-locks concurrency https://blog.nt2.me/no-analytics-on-the-marketing-site https://blog.nt2.me/no-analytics-on-the-marketing-site Fri, 28 Aug 2026 00:00:00 GMT A privacy product should not ask you to accept tracking just to read its privacy promise. NT² trust privacy marketing https://blog.nt2.me/attachment-ciphertext-outside-sqlite https://blog.nt2.me/attachment-ciphertext-outside-sqlite Wed, 26 Aug 2026 00:00:00 GMT A vault needs to know which files belong to which items, how large they are, and how to unwrap their keys. It does not need those encrypted bytes sitting inside the relational database that answers those questions. NT² attachments sqlite blobstore opfs envelope-encryption local-first aes-gcm chunking https://blog.nt2.me/structured-security-under-three-dollars https://blog.nt2.me/structured-security-under-three-dollars Tue, 25 Aug 2026 00:00:00 GMT A privacy tool for everyday households cannot price itself like enterprise software and still claim to be for everyone. NT² trust pricing product https://blog.nt2.me/fts5-vs-table-scan-in-the-vault https://blog.nt2.me/fts5-vs-table-scan-in-the-vault Sat, 22 Aug 2026 00:00:00 GMT Local search is not one query shape. Free-text wants a full-text index on titles and search text. Category, trash, archive, and similar filters want ordinary table predicates. The product switches strategy so the UI never has to ship the whole vault into memory to feel searchable. NT² architecture local-first sqlite fts5 search performance pwa https://blog.nt2.me/offline-by-default-not-offline-only https://blog.nt2.me/offline-by-default-not-offline-only Fri, 21 Aug 2026 00:00:00 GMT A vault can work offline and still offer sync. The difference is whether the cloud becomes the owner of the data or just a blind carrier. NT² trust sync privacy https://blog.nt2.me/paged-list-not-full-table-load https://blog.nt2.me/paged-list-not-full-table-load Wed, 19 Aug 2026 00:00:00 GMT A local vault can hold thousands of structured items without becoming a giant in-memory array. The durable store stays in SQLite. The UI holds only a paged window of lightweight list rows, rendered through a virtual list. NT² architecture local-first sqlite svelte performance virtual-list pagination pwa https://blog.nt2.me/look-at-my-screen-not-my-vault https://blog.nt2.me/look-at-my-screen-not-my-vault Tue, 18 Aug 2026 00:00:00 GMT A friend asks to check the account number. You want to help, but you do not want your unlocked vault in someone else's hands. NT² present privacy family https://blog.nt2.me/no-password-oracle-in-d1 https://blog.nt2.me/no-password-oracle-in-d1 Sat, 15 Aug 2026 00:00:00 GMT An account table can contain no plaintext vault items and still create a dangerous password-testing surface. We removed the columns that could turn a database copy into an offline guessing or recovery system. NT² architecture security privacy zero-knowledge edge cloudflare d1 authentication https://blog.nt2.me/timed-reveal-on-a-video-call https://blog.nt2.me/timed-reveal-on-a-video-call Fri, 14 Aug 2026 00:00:00 GMT The person on the call needs to confirm one field. Your screen is ready to show an entire document. NT² present document privacy https://blog.nt2.me/vault-durable-object-per-key-did https://blog.nt2.me/vault-durable-object-per-key-did Wed, 12 Aug 2026 00:00:00 GMT A vault does not need to enter a shared plaintext mailbox to sync. Its public cryptographic identity can name a dedicated edge coordinator that notifies replicas and points them to encrypted frames it cannot open. NT² architecture sync privacy durable-objects key-did edge https://blog.nt2.me/sent-to-me-means-ciphertext-to-you https://blog.nt2.me/sent-to-me-means-ciphertext-to-you Tue, 11 Aug 2026 00:00:00 GMT The vault app lives at se.nt2.me: sent to me. The phrase is playful, but the product idea is not. NT² share brand trust https://blog.nt2.me/no-password-reset-by-design https://blog.nt2.me/no-password-reset-by-design Sat, 08 Aug 2026 00:00:00 GMT “Contact support to reset your password” sounds reassuring. For an encrypted vault, it also reveals who ultimately controls access. NT² chooses a harder promise: recovery material stays with you, not our help desk. NT² security recovery zero-knowledge trust local-first https://blog.nt2.me/something-arrived-in-my-inbox https://blog.nt2.me/something-arrived-in-my-inbox Fri, 07 Aug 2026 00:00:00 GMT Most sharing stories focus on the sender. The recipient has a quieter problem: should I trust this file, and where should it go if I do? NT² share inbox trust https://blog.nt2.me/blind-replica-sync-on-the-edge https://blog.nt2.me/blind-replica-sync-on-the-edge Wed, 05 Aug 2026 00:00:00 GMT Sync does not have to turn a local vault into a cloud database. The edge can identify an account, store opaque replica frames, and deliver updates without learning what those updates contain. NT² architecture sync privacy local-first zero-knowledge edge https://blog.nt2.me/usb-stick-beats-email https://blog.nt2.me/usb-stick-beats-email Tue, 04 Aug 2026 00:00:00 GMT If the file is too sensitive for a chat thread, sending it through one more inbox is not automatically better. NT² share privacy document https://blog.nt2.me/opfs-not-indexeddb-for-vault-sqlite https://blog.nt2.me/opfs-not-indexeddb-for-vault-sqlite Sat, 01 Aug 2026 00:00:00 GMT SQLite wants a file. A privacy vault wants durable relational storage that stays fast as its item count, indexes, and encrypted attachments grow. Putting a SQLite virtual file system on IndexedDB can bridge those worlds, but it makes the bridge part of every database operation. For NT² Vault, the browser vault file belongs in the Origin Private File System. NT² opfs indexeddb sqlite wasm wa-sqlite local-first pwa browser-storage https://blog.nt2.me/one-time-disclosure-lawyer-accountant https://blog.nt2.me/one-time-disclosure-lawyer-accountant Fri, 31 Jul 2026 00:00:00 GMT Your accountant needs the statement today. They do not need a permanent copy sitting in three inboxes and a downloads folder. NT² share document privacy https://blog.nt2.me/unlock-local-auth-cloud https://blog.nt2.me/unlock-local-auth-cloud Wed, 29 Jul 2026 00:00:00 GMT One screen can make two security events look like a single login. We keep them separate because opening encrypted data and proving an identity to a server are different jobs with different risks. NT² authentication local-first privacy security cryptography cloud https://blog.nt2.me/send-production-keys-to-cofounder https://blog.nt2.me/send-production-keys-to-cofounder Tue, 28 Jul 2026 00:00:00 GMT Your co-founder needs the production key before a weekend deploy. They do not need your personal vault, your old notes, or a zip file of everything. NT² share credential startup https://blog.nt2.me/envelope-encryption-cek-per-object https://blog.nt2.me/envelope-encryption-cek-per-object Sat, 25 Jul 2026 00:00:00 GMT A vault can encrypt everything with one key and still claim that its data is encrypted. We wanted a more useful boundary: each item and attachment gets its own content encryption key, while the vault key protects those keys. NT² envelope-encryption aes-gcm cryptography local-first attachments opfs security https://blog.nt2.me/large-vault-still-fast https://blog.nt2.me/large-vault-still-fast Fri, 24 Jul 2026 00:00:00 GMT The first fifty items are easy. The real test is whether a vault still feels calm after years of credentials, documents, bank records, and notes. NT² store performance search https://blog.nt2.me/kdf-salt-stays-on-device https://blog.nt2.me/kdf-salt-stays-on-device Thu, 23 Jul 2026 00:00:00 GMT A salt is not a secret. Still, where it lives changes who can assemble a password-guessing system. NT² keeps the KDF salt and password verifier with the local vault, so unlocking begins and ends on the device. NT² architecture crypto security local-first zero-knowledge web-crypto pbkdf2 key-derivation https://blog.nt2.me/work-vault-personal-vault https://blog.nt2.me/work-vault-personal-vault Tue, 21 Jul 2026 00:00:00 GMT Your laptop holds client API keys, a family insurance policy, and a crypto wallet note. The problem is not storage space. It is boundaries. NT² store privacy credential https://blog.nt2.me/one-person-ai-coding-agent-product-lifecycle https://blog.nt2.me/one-person-ai-coding-agent-product-lifecycle Mon, 20 Jul 2026 00:00:00 GMT The useful question is not whether an AI agent can write code. It is how to give agents enough context and autonomy to move quickly while keeping product decisions, security boundaries, releases, and customer-facing actions under explicit human control. NT² ai-agents human-in-the-loop spec-driven-development tdd devops security product-development https://blog.nt2.me/three-stripe-keys-three-environments https://blog.nt2.me/three-stripe-keys-three-environments Fri, 17 Jul 2026 00:00:00 GMT The note says API stuff. Inside are three Stripe keys, two webhook secrets, an old test token, and no one remembers which one is safe to paste. NT² store credential https://blog.nt2.me/embassy-appointment-no-signal https://blog.nt2.me/embassy-appointment-no-signal Tue, 14 Jul 2026 00:00:00 GMT You are outside the consulate, the appointment is in twelve minutes, and the confirmation email will not load. NT² store document travel https://blog.nt2.me/not-another-password-manager-login https://blog.nt2.me/not-another-password-manager-login Fri, 10 Jul 2026 00:00:00 GMT Website logins already have good tools. The harder question is where to keep the secrets that are not just username, password, and URL. NT² store credential crypto https://blog.nt2.me/why-pwa-local-first-zero-server-vault https://blog.nt2.me/why-pwa-local-first-zero-server-vault Thu, 09 Jul 2026 00:00:00 GMT In the era of massive cloud-first applications, we often overlook a powerful alternative: the Progressive Web App (PWA). Why maintain a heavy, expensive, and potentially vulnerable server infrastructure when the modern browser is capable of running a full-featured, secure, and high-performance application entirely on the user's device? NT² architecture pwa privacy security local-first zero-knowledge web-crypto sqlite wasm opfs https://blog.nt2.me/paper-notebook-family-handoff https://blog.nt2.me/paper-notebook-family-handoff Tue, 07 Jul 2026 00:00:00 GMT The notebook sits in the kitchen drawer. Everyone knows it matters. Nobody is sure whether the bank password on page seven is still current. NT² store family backup https://blog.nt2.me/spreadsheet-on-my-desktop https://blog.nt2.me/spreadsheet-on-my-desktop Fri, 03 Jul 2026 00:00:00 GMT The file started as a budget. Then someone added insurance details, bank accounts, passport numbers, and a few passwords. Now the most sensitive document in the house is called Family.xlsx. NT² store bank document family https://blog.nt2.me/threshold-vault-key-did-self-sovereign-identity https://blog.nt2.me/threshold-vault-key-did-self-sovereign-identity Tue, 30 Jun 2026 00:00:00 GMT Self-sovereign identity sounds abstract. In NT², the practical version is simpler: your vault can prove itself, recover without a help desk, and share under your control while NT² stays blind. NT² trust identity https://blog.nt2.me/building-nt2-vault-june-2026 https://blog.nt2.me/building-nt2-vault-june-2026 Mon, 29 Jun 2026 00:00:00 GMT A short changelog for early followers. NT² Vault is still pre-launch—this note covers what we shipped recently, not the full product map. NT² product pre-launch roadmap https://blog.nt2.me/api-keys-in-slack https://blog.nt2.me/api-keys-in-slack Sun, 28 Jun 2026 00:00:00 GMT The contractor needed the Stripe key before deploy. You pasted it in #engineering. The key is rotated now—and the thread is still searchable forever. NT² share credential pre-launch https://blog.nt2.me/id-photos-on-messaging-apps https://blog.nt2.me/id-photos-on-messaging-apps Sun, 28 Jun 2026 00:00:00 GMT Front and back of your ID in WhatsApp or LINE is fast for the landlord—and a permanent copy in a chat log you do not control. NT² share document pre-launch https://blog.nt2.me/mortgage-proof-show-less-not-upload-more https://blog.nt2.me/mortgage-proof-show-less-not-upload-more Sun, 28 Jun 2026 00:00:00 GMT The broker wanted employer name and the last four digits of your account. You emailed a twelve-page PDF. That is oversharing dressed as diligence. NT² present bank pre-launch https://blog.nt2.me/seed-phrase-in-apple-notes https://blog.nt2.me/seed-phrase-in-apple-notes Sun, 28 Jun 2026 00:00:00 GMT If your recovery phrase is in Apple Notes, iCloud is doing backup. That is not the same as zero-knowledge—and it is not the same as structured, masked fields with auto-lock. NT² store crypto pre-launch https://blog.nt2.me/split-rent-without-banking-screenshots https://blog.nt2.me/split-rent-without-banking-screenshots Sun, 28 Jun 2026 00:00:00 GMT Every month you paste a banking-app screenshot into the family group. Your brother's phone, cloud backup, and search history are now copies you never meant to keep. NT² share bank pre-launch https://blog.nt2.me/what-null-trust-squared-means https://blog.nt2.me/what-null-trust-squared-means Sun, 28 Jun 2026 00:00:00 GMT NT² stands for Null Trust². The name is a promise about what we cannot do—even when that is inconvenient for support and onboarding. NT² trust pre-launch product https://blog.nt2.me/welcome-to-nt2-blog https://blog.nt2.me/welcome-to-nt2-blog Mon, 08 Jun 2026 00:00:00 GMT This is where we publish product stories—not spec sheets—about structured privacy, local-first vaulting, and handing sensitive data to another person without email attachments or chat screenshots. NT² product blog pre-launch