My Data Manager

Password managers and note-taking apps store data in plaintext on their servers. Even with "encryption at rest," the provider holds the keys. For truly sensitive information — credentials, API keys, personal documents — zero-trust encryption is the only acceptable model.

Built a self-hosted platform using Node.js native crypto module. The core principle: encryption keys are derived at runtime from the user's password using PBKDF2 and are never stored anywhere. Without the password, the data is mathematically inaccessible.

• Backend: Node.js, Express.js
• Encryption: AES-256-GCM via Node.js native crypto module
• Key Derivation: PBKDF2 with per-user random salts
• Storage: MongoDB with encrypted fields only
• Client: Minimal frontend for credential and file management

Key management without key storage. The encryption key must be derived fresh on every login from the password + salt. Implemented a session-based key caching strategy where the derived key lives only in memory for the session duration and is discarded on logout.

• Zero plaintext data in database — every field is encrypted
• Encryption keys never stored or transmitted
• AES-256-GCM with authenticated encryption prevents tampering
• PBKDF2 with 100000 iterations resists brute force