planet 01 of 08 · security · product
Zcrypt
Zero-Knowledge Encrypted Cloud Storage Platform
Files are encrypted client-side with AES-256-GCM before upload, so the server can never read them. One Go backend, three clients: web, desktop (Tauri), and terminal (TUI).
About
from the readme on github- Designed and shipped a zero-knowledge cloud storage platform (zcrypt.cloud) where the server cannot decrypt user files, same threat model as Bitwarden / 1Password; positioned as an open-source Dropbox / Google Drive alternative.
- Built three client surfaces against a single Go backend: a Next.js web app (Bun runtime), a Tauri cross-platform desktop app, and a Bubble Tea terminal client (TUI), all consuming a custom stdlib HTTP server with zero framework dependencies.
- Implemented client-side AES-256-GCM encryption with PBKDF2 key derivation and zstd compression via Web Crypto API + WebAssembly, so the server only ever handles opaque encrypted blobs.
- Engineered a chunked upload/download pipeline with repo-pool auto-rotation distributing encrypted chunks across GitHub, GitLab, and HuggingFace, a bring-your-own-backend (BYOB) architecture with no commercial cloud dependency.
Zero-knowledge, end-to-end encrypted cloud storage that lives inside _your own_ GitHub, GitLab, HuggingFace, and Telegram accounts.
Your files are compressed, encrypted, and split into chunks _on your device_ before they ever move. The server never sees your passphrase. The storage platforms never see your plaintext. zcrypt is free and open source — there are no paid tiers.
What zcrypt is
zcrypt turns storage you already have — GitHub, GitLab, HuggingFace, and Telegram — into a single encrypted drive. Files are compressed with zstd, encrypted with AES-256-GCM under a key that never leaves your device, split into chunks, and stored across those platforms behind disguised repositories and innocuous filenames.
Because encryption happens client-side, zcrypt is zero-knowledge: the server stores only ciphertext, encrypted filenames, a wrapped key, and a salt. It cannot read your files, recover your passphrase, or hand your plaintext to anyone — because it never has them.
How it works
Every file goes through the same client-side pipeline before a single byte leaves your device:
Download reverses it: chunks are fetched and verified (per-chunk integrity), reassembled, decrypted with your passphrase, and decompressed — all locally.
The zero-knowledge trust boundary
The line between what stays on your device and what the server can ever see is the whole point of the product: