txtvault

save you text securely, AD free, encrypted, secure, multi-layerd encryption.

txtvault is a serverless, login-free, zero-knowledge encrypted text vault.

Built entirely as a client-side Single Page Application (SPA), it allows users to securely store and retrieve multi-line Markdown ledgers without ever creating an account. The server never sees the master password or the unencrypted data.

Once open source, always open source. Once free, always free.

---

live - https://fiozxr.github.io/txtvault/

---

🔒 Architecture: The "Russian Doll" Encryption

txtvault relies on a dual-cryptography model to achieve complete zero-knowledge storage while completely bypassing traditional authentication (like OAuth or email/password).

1. The Database Location (SHA-256): The Vault ID and Master Password are concatenated and hashed using SHA-256. This resulting 64-character hash becomes the exact Document ID in the Firestore database.
2. The Payload (AES): The user's ledger (a JSON array of timestamps and markdown text) is stringified and fully encrypted using AES-256, keyed by the Master Password.
3. The Guarantee: Firestore only receives a random string of characters (the Document ID) containing a payload of mathematically random gibberish (the AES ciphertext). Even if the database is fully compromised, the data remains unreadable and unattributable.

✨ Features

• Zero Friction: No signup, no email verification. Your Vault ID and Password are your account.
• Client-Side Cryptography: Powered by CryptoJS. Keys and plain-text never leave the browser.
• Markdown Support: Entries are rendered in clean HTML using marked.js.
• Immutable Ledger: Data is stored as an array of time-stamped entries.
• ** Glassmorphism UI:** A highly aesthetic, minimalist, dark mode interface.

---

🚀 Getting Started (Local Deployment)

Because txtvault uses Firebase's modular v9 SDK via CDN, there is no Node.js, Webpack, or build step required.

1. Clone the Repository.

git clone https://github.com/fiozxr/txtvault
cd txtvault

2. Set Up Firebase (Backend)

You must configure a Firestore database to act as the blind storage backend.

1. Go to the Firebase Console and create a new project.
2. Navigate to Build > Firestore Database and click Create Database (Start in Production mode).
3. Register a new Web App in your Firebase Project Settings to generate your config object.

3. Connect the App

Open app.js and locate the firebaseConfig block at the top of the file. Replace it with the keys generated by your Firebase console:

const firebaseConfig = {
  apiKey: "YOUR_API_KEY",
  authDomain: "YOUR_PROJECT_ID.firebaseapp.com",
  projectId: "YOUR_PROJECT_ID",
  storageBucket: "YOUR_PROJECT_ID.appspot.com",
  messagingSenderId: "YOUR_SENDER_ID",
  appId: "YOUR_APP_ID"
};

4. Run Locally

Simply open index.html in any modern web browser. No local server required.

🛡️ Critical: Firestore Security Rules

Because txtvault operates without Firebase Authentication, you must apply specific security rules to prevent malicious actors from wiping the database or scraping the encrypted payloads. In your Firebase Console, navigate to Firestore > Rules and paste the exact code below.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    
    // Target only the 'vaults' collection
    match /vaults/{vaultId} {
      
      // READ RULES:
      // 'get' allows fetching a document ONLY if the client requests the exact SHA-256 hash.
      allow get: if true; 
      
      // 'list' MUST BE FALSE. This prevents hackers from querying/downloading all vaults.
      allow list: if false; 

      // WRITE RULES:
      // Allow creation/updates, but strictly enforce that the payload is a string.
      // This prevents users from uploading massive files and blowing out the free tier.
      allow create, update: if request.resource.data.encryptedText is string;
      
      // Prevent deletion to protect against blind wipeout scripts.
      allow delete: if false; 
    }
  }
}

Why these rules matter:

• allow list: if false makes the database effectively invisible. A document can only be retrieved if the exact 64-character SHA-256 hash is provided.
• allow create, update: if ... is string sanitizes inputs and protects your bandwidth.

📜 License

This project is licensed under the MIT License - see the LICENSE file for details.