Ownfold
Composable encryption and vault coordination for backend, browser, and full-stack TypeScript applications, with no hosted Ownfold service.
Ownfold is a runtime-independent TypeScript SDK for encrypted application data. Use it as a pure backend coordination service, a trusted backend encryption engine, a browser end-to-end encrypted vault, or a full-stack integration. React and browser packages are optional.
Core guarantees
- No Ownfold-operated service or runtime network dependency.
- No vendor account, API key, telemetry endpoint, or per-user pricing.
- Record plaintext and vault keys stay out of the application server.
- Recovery is controlled by the user through a password-protected Recovery Kit.
- Persisted formats are strictly validated, authenticated, and versioned.
Installation
Pick only the backend, frontend, framework, auth, database, or crypto layers you need.
Backend quickstart
Run a standalone Node API without React or any browser package.
Browser quickstart
Create a user-controlled vault and persist a ciphertext-only record.
Examples
Run React, Next.js, Start, Express, Fastify, Elysia, Hono, and tRPC integrations.
Threat model
Learn what Ownfold protects and what browser E2EE cannot protect.
Architecture
Understand browser cryptography, server coordination, and application storage.
Persisted formats
Review the encrypted-envelope and Recovery Kit format decisions.
Framework integrations
Connect Next.js, Fastify, Hono, Elysia, Express, TanStack Start, or tRPC.
Current status
The cryptographic and recovery foundation, browser lifecycle, device enrollment and pairing, cross-tab locking, resumable root-key rotation, framework/authentication adapters, SQLite and real PostgreSQL adapter compliance, production examples, and guarded release process are implemented as a public beta. An independent security review, manual assistive-technology sign-off, public provenance-enabled npm release setup, and canonical documentation deployment still gate any production-ready claim. See the exact beta-readiness evidence and gates.
Choose the security boundary
| Path | Where encryption runs | Does the backend see plaintext? |
|---|---|---|
| Backend coordination | Client selected by your application | No |
| Trusted backend encryption | Service, worker, job, or CLI | Yes, during processing |
| Browser E2EE | User’s browser worker | No |
The backend SDK is independently usable and contains no frontend dependency. Browser E2EE is the strongest Ownfold trust model, but it is not the only supported runtime architecture.
Losing every authorised device and the Recovery Kit permanently loses access to encrypted data.
Learn by layer
- Get started splits backend-only and browser E2EE onboarding into independent paths.
- Backend SDK covers direct server operations, HTTP exposure, and trusted service encryption.
- Frontend SDK covers the vanilla browser client and optional headless React hooks.
- Core concepts explains architecture, key hierarchy, recovery, devices, and lifecycle states.
- Integrations provides framework, authentication, and database-specific mounting instructions.
- Guides shows ciphertext-only application record patterns and operational deployment flows.
- API reference documents packages, clients, server behavior, contracts, errors, and formats.
- Security contains the threat model, host hardening, unsafe examples, and audit evidence.
Every page is available as Markdown, included in llms.txt, searchable without a hosted service,
and linked to its source for corrections. Coding agents can also discover the integration skill and
read-only WebMCP tools through AI and agent access.
Documentation map
- Backend: backend overview, backend quickstart, vault server, trusted encryption, and server API.
- Frontend: frontend overview, browser quickstart, browser client, and React hooks.
- Frameworks: Next.js, Fastify, Hono, fetch, and tRPC.
- Authentication: Better Auth, Auth.js, and custom authentication.
- Architecture: key hierarchy, vault lifecycle, integration boundaries, product specification, and roadmap.
- Decisions and contribution: device identity, package boundaries, and documentation contribution.