project 01 of 08 · security · product
Zcrypt
Zero-Knowledge Encrypted Cloud Storage Platform
Files are encrypted client-side with AES-256-GCM before upload, so the server can never read them. One Go backend, three clients: web, desktop (Tauri), and terminal (TUI).
About
from the readme on github- Designed and shipped a zero-knowledge cloud storage platform (zcrypt.cloud) where the server cannot decrypt user files, same threat model as Bitwarden / 1Password; positioned as an open-source Dropbox / Google Drive alternative.
- Built three client surfaces against a single Go backend: a Next.js web app (Bun runtime), a Tauri cross-platform desktop app, and a Bubble Tea terminal client (TUI), all consuming a custom stdlib HTTP server with zero framework dependencies.
- Implemented client-side AES-256-GCM encryption with PBKDF2 key derivation and zstd compression via Web Crypto API + WebAssembly, so the server only ever handles opaque encrypted blobs.
- Engineered a chunked upload/download pipeline with repo-pool auto-rotation distributing encrypted chunks across GitHub, GitLab, and HuggingFace, a bring-your-own-backend (BYOB) architecture with no commercial cloud dependency.
Zero-knowledge, end-to-end encrypted cloud storage that lives inside _your own_ GitHub, GitLab, HuggingFace, and Telegram accounts.
Your files are compressed, encrypted, and split into chunks _on your device_ before they ever move. The server never sees your passphrase. The storage platforms never see your plaintext. zcrypt is free and open source. There are no paid tiers.
What zcrypt is
zcrypt turns storage you already have (GitHub, GitLab, HuggingFace, and Telegram) into a single encrypted drive. Files are compressed with zstd, encrypted with AES-256-GCM under a key that never leaves your device, split into chunks, and stored across those platforms behind disguised repositories and innocuous filenames.
Because encryption happens client-side, zcrypt is zero-knowledge: the server stores only ciphertext, encrypted filenames, a wrapped key, and a salt. It cannot read your files, recover your passphrase, or hand your plaintext to anyone, because it never has them.
How it works
Every file goes through the same client-side pipeline before a single byte leaves your device:
Download reverses it: chunks are fetched and verified (per-chunk integrity), reassembled, decrypted with your passphrase, and decompressed, all locally.
The zero-knowledge trust boundary
The line between what stays on your device and what the server can ever see is the whole point of the product: