VaultDrop

VaultDrop is a way to send passwords, API keys and private notes without leaving them in a chat log or an inbox. You paste a secret, get a link, and the link opens once. After that, the secret is gone from the server for good. It runs at vaultdrop.vante.app, and there's an npm CLI for sharing straight from the terminal or CI.

What it does

Zero-knowledge encryption

• Secrets are encrypted in the browser (or the CLI) with AES-256-GCM before anything is sent
• The key travels only in the link's #fragment, so the server stores ciphertext it can never read
• An optional passphrase, derived with Argon2id, adds a second factor. A wrong passphrase never uses up the secret, and too many wrong attempts destroy it

Truly one-time links

• One-time or N-time links that stay correct under concurrent requests: the row is locked, the proof verified and the ciphertext deleted in the same transaction
• Expiry from minutes to days, plus a private receipt link to see whether a secret was read, or to destroy it before anyone does

Accounts and developers

• Optional accounts with email verification, passkeys, TOTP 2FA, session management and organizations. None of it is needed to share a secret
• A versioned REST API with an OpenAPI spec, scoped and hashed API keys, idempotency keys and signed webhooks
• A vaultdrop CLI that uses the same envelope format as the web app, with interoperability tests that keep the two in sync

How it's built

The app is Next.js running on Bun, with PostgreSQL through Drizzle and optional Redis to take the load of rate limiting off the database. In development it uses an embedded PostgreSQL (PGlite) that migrates itself, so you don't need a database server to get started. Redemption is a small state machine inside a single database transaction, which is what makes "opens once" hold up even when two requests arrive at the same moment. Stripe billing is built in behind centralized plan entitlements and stays off until it's configured. Unit and integration tests run on Bun, and a Playwright suite tests the production build end to end.

Role & Responsibilities

I designed and built the whole project on my own: the encryption envelope and threat model, the redemption logic, the web app and dashboard, the public API and its docs, the CLI, and the deployment setup.