---
title: "Vault — Parth Kapoor"
description: "Self-hosted, GitHub-authenticated vault for files, blogs, and passwords"
canonical: "https://parthkapoor.me/builds/vault"
---

# Vault

> Self-hosted, GitHub-authenticated vault for files, blogs, and passwords

Vault is a personal cloud storage app that stores files, Markdown blog posts, and passwords behind GitHub authentication. It is backed entirely by Cloudflare R2, so there is no separate database or Redis instance to run — a single admin (identified by GitHub email) gets full read/write access, and everyone else sees only items explicitly marked public.

Uploads go straight from the browser to R2 via presigned URLs, avoiding serverless upload size limits, while blog posts are Markdown/MDX rendered with a live-preview editor. The password vault is zero-knowledge: a master passphrase derives an AES-256-GCM key in the browser via PBKDF2 (600k iterations), so R2 and the server only ever see ciphertext.

- Status: shipped
- Language: TypeScript
- Started: Jun 2025
- License: MIT
- Live: https://lnx.parthkapoor.me
- Source: https://github.com/parthkapoor-dev/vault

## Highlights

- Zero-knowledge password vault: encryption key is derived and used only in the browser, server never sees plaintext
- No database or Redis — all state lives in Cloudflare R2, including a single encrypted blob for passwords
- Stateless GitHub OAuth flow using a signed JWT cookie (jose), no auth database
- Per-item public/private visibility toggle on every file, folder, and blog post
- Direct-to-R2 browser uploads via presigned URLs, bypassing serverless size limits

## Stack

- **Framework**: Next.js 16, React 19, TypeScript
- **Storage**: Cloudflare R2, @aws-sdk/client-s3
- **Auth & Security**: jose (JWT), Web Crypto API
- **Content**: Tailwind CSS, next-mdx-remote

All builds: [https://parthkapoor.me/builds](https://parthkapoor.me/builds.md)