Nook

Nook is a passwordless, local first, decentralized secrets manager

Comment

Inspiration

Most password managers still depend on a central account and a master password. That creates two major risks: the password can be stolen or forgotten, and access ultimately depends on a company’s infrastructure.

We built Nook to offer a fundamentally different model: passwordless, decentralized vault access controlled by trusted devices - not accounts.

What Nook does

Nook is an open-source password and secrets manager with:

  • No Nook account
  • No master password
  • No central vault server
  • No provider-controlled recovery
  • No plaintext secrets leaving the browser

Each approved device has its own cryptographic identity, protected by a passkey or local PIN. Vault keys are encrypted separately for authorized devices, so users control who can unlock their data.

Nook stores passwords, passkeys, API keys, authenticator codes, secure notes, and seed phrases. Encrypted data can remain local or synchronize through storage chosen by the user, including GitHub, Google Drive, iCloud, and local folders.

For highly sensitive secrets, Sentinel Vault adds decentralized quorum protection: multiple trusted devices must cooperate before the vault can be opened.

How we built it

Security-critical logic runs in Rust compiled to WebAssembly. Svelte provides the interface, while encryption, validation, passkeys, imports, and synchronization remain inside the typed Rust/WASM boundary.

Changes are stored as signed, encrypted events. Devices merge these immutable events instead of trusting a central database, allowing replicas to converge without silently overwriting one another.

We used OpenAI Codex as an engineering collaborator for implementation, testing, review, and debugging. Codex supports development but never participates in vault access or receives user secrets.

Why Nook is different

Nook combines capabilities rarely available together in one password manager:

  • Passwordless access without a central account
  • User-owned device identities
  • Decentralized encrypted synchronization
  • Multi-device quorum protection
  • Client-side Rust/WASM cryptography
  • Open-source, inspectable security boundaries

Nook is built around one simple principle:

Your devices hold the keys. Your storage holds only ciphertext. You control access.

Built With

Share this project:

Updates