Scheduled
8 min read By NT²
What the Workers are allowed to see
Tech
Zero-knowledge is not a slogan about HTTPS. It is a permission list for the edge: what Workers may store, route, and bill for—and what they are never allowed to learn.
Tech
Engineering deep dives into the architecture and implementation behind NT² Vault.
48 posts
Scheduled
8 min read By NT²
.nt2backup as a sovereignty format
Tech
Local-first only means ownership if you can leave with an encrypted snapshot the cloud never had to hold. .nt2backup is that snapshot: portable vault profile sections and sealed payloads in a file you control.
Scheduled
8 min read By NT²
Same vault UI in browser, PWA, and desktop shells
Tech
Unlock, list, search, and settings should not fork into three products. NT² Vault keeps one vault UI and lets each shell own only what the platform must own: how durable files live on that device.
Scheduled
8 min read By NT²
Vault profile is section KV, not one mega-row
Tech
Salt, Key DID public material, sync cursors, and onboarding prefs are not one fat SQL row. They live as named vault profile sections—so backup, sync, and unlock can each touch only what they need.
Scheduled
8 min read By NT²
Schema v60 and incremental migration
Tech
A local vault is a real SQLite database on your device. When the product ships schema v60, launch-era vaults must upgrade in place—not force a wipe because the CREATE statement changed in the source tree.
Scheduled
8 min read By NT²
Wrong password must fail closed
Tech
Unlock is not a best-effort decrypt of everything you own. NT² checks a small local verifier first. Wrong password fails closed: the vault stays locked, and the UI stays honest.
Scheduled
9 min read By NT²
CBF is how structured fields leave RAM
Tech
A credential is a map of fields while you edit it. The moment those fields must survive a lock, a restart, or a replica, they need a portable ciphertext shape—not a JSON dump waiting for the next reader.
Scheduled
9 min read By NT²
Auto-lock is a memory hygiene problem
Tech
Encryption at rest is incomplete if the decrypted key handle outlives the unlocked session. NT² treats auto-lock as memory hygiene: non-extractable CryptoKeys, in-memory only, cleared on idle, refresh, and tab close.
Scheduled
8 min read By NT²
SQLite in a Web Worker is not optional
Tech
A local-first vault needs a real relational engine on device. Putting that engine on the UI thread makes every page query compete with paint and input. NT² Vault runs SQLite in a Web Worker, behind typed messages and a single lock chain, so the list can stay responsive while the database stays honest.
Scheduled
9 min read By NT²
Selective SSI — not a general DIDComm wallet
Tech
Self-sovereign identity is useful when you take the parts that fit a zero-knowledge vault—and refuse the parts that turn the product into a general DID wallet.