Open-source encryption infrastructure
Encryption your
users can own.
Add user-controlled encrypted data to TypeScript apps without sending keys, plaintext, or telemetry to an Ownfold service.
A vault that belongs to the user.
Plaintext is available only inside the trusted runtime. Your backend coordinates ciphertext, devices, and rotation—never the root key.
Zerohosted dependency
Zeroplaintext on your server
Onecomposable TypeScript stack
Openformats and source
01 / Define the boundary
Your server coordinates.
The client keeps the keys.
Ownfold separates vault coordination from cryptography, so your database can store useful application records without gaining access to their contents.
Explore the threat model02 / Compose your stack
Bring the tools you already run.
Choose only the layers you need. Ownfold works as a backend SDK, a browser E2EE client, or a complete full-stack path with typed adapters.
Explore integrationsBuild from primitives
Everything needed for an
ownership-first vault.
Vault coordination
Typed server operations for records, devices, pairing, and policy enforcement.
↗02Runtime encryption
Authenticated, versioned envelopes built on modern cryptographic primitives.
↗03User recovery
Password-protected Recovery Kits that keep access under the user's control.
↗04Safe key rotation
Resumable root-key rotation with explicit progress and recovery semantics.
↗Own the trust boundary
Ship encrypted data
without renting trust.
Start with a focused package, then add adapters as your application grows.
Read the installation guide