featured projectMay 2026 - Present

Enclave

Your notes, your devices, your rules — encrypted end to end and impossible to phone home.

No cloud. No servers. No internet required.

Zero-knowledge
Keys never leave the device
LAN-only
Authenticated P2P sync
Offline RAG
Ask your vault anything
4 platforms
Windows, Linux, macOS, Android

View source All projects

Why it stands out

The decisions, trade-offs, and details that make Enclave worth your time.

Zero-knowledge: a 12-word BIP39 seed phrase never leaves the device; Argon2id derives the key

Encrypted device-to-device sync over local Wi-Fi with a mutual-auth handshake — no servers

An offline RAG assistant answers across your vault without a byte leaving the machine

Desktop (Tauri v2) plus a signed Android beta from one Rust + Svelte codebase

How it works

Enclave is built on three core principles — local-first data ownership, zero-knowledge encryption, and peer-to-peer sync — keeping your knowledge private while making it available across your devices, on or offline.

Local-first

All data lives on your device first. Create, edit, and organize pages fully offline — sync is an enhancement, not a requirement.

Zero-knowledge encryption

The vault is encrypted with SQLCipher (AES-256-CBC with HMAC-SHA512) before it touches storage. Keys are derived with Argon2id (64 MiB, 3 iterations, 4 parallelism) from a 12-word BIP39 seed phrase that never leaves your device.

Authenticated P2P sync

Devices on the same Wi-Fi discover each other via mDNS and sync over WebSocket channels secured with mutual authentication — a challenge-response HMAC-SHA256 handshake over the vault-derived sync key, then every frame sealed with XChaCha20-Poly1305. Wrong-key peers are rejected before any data is exchanged.

Zero telemetry

The application makes zero outbound network requests beyond the optional AI endpoint you configure. All sync traffic is local-network-only — your notes never touch the internet.

Desktop + Android

Built on Tauri v2 (Rust) for a small footprint and native performance — Windows, Linux, and macOS installers, plus a signed Android beta (.apk/.aab) built in CI from the same SvelteKit frontend and Rust core.

Offline RAG assistant

Ask questions across your vault with retrieval-augmented generation: an in-database sqlite-vec ANN index inside the encrypted vault file, exact-cosine re-ranking in Rust, and fully offline ONNX embeddings — retrieval never leaves your device.

Vault & security

Your vault is encrypted before it touches persistent storage, and keys are derived from credentials that never leave your device.

First launch — create a vault

A 12-word BIP39 English seed phrase is generated client-side. You must save it — it is the only way to unlock your vault. Re-enter the phrase to confirm, and the encrypted vault is created.

Returning — unlock with the seed phrase

The phrase is validated and run through Argon2id (64 MiB, 3 iterations, 4 parallelism) to derive the 256-bit master key, which decrypts the SQLCipher database.

Zero-trust sync

Peers must prove knowledge of the vault-derived sync key via a challenge-response handshake (HMAC-SHA256) before any data — even the hello — is exchanged. Every frame is then sealed with XChaCha20-Poly1305 (AEAD) under a per-session key; other devices on the Wi-Fi see only challenges and ciphertext.

Key material stays in memory

The seed phrase and derived keys exist only in memory during the session and are never written to disk.

Crypto flow

12-word mnemonic
      │
      ▼
Argon2id(password=mnemonic, salt="enclave-vault-master-key-v1")
      │
      ▼
256-bit master key ────► SQLCipher PRAGMA key (encrypt-at-rest DB)
      │
      └── HKDF-SHA256 ──► sync key ──► peer auth (HMAC-SHA256 proofs)
                                       + transport (XChaCha20-Poly1305)

Editor

A TipTap (ProseMirror) editor wrapped for Svelte 5, with slash-command blocks and markdown round-trip export.

Headings/h1, /h2, /h3

Lists/bullet, /numbered

Task lists/task

Block quotes/quote

Code blocks/code

Callouts/callout

Toggle blocks/toggle

Divider/divider

Bubble menu formattingselection

Command paletteCtrl+K

Markdown exporttoolbar

Tech stack

Every layer is chosen for safety, speed, and simplicity.

RustTauri v2Svelte 5SQLCipherP2P syncXChaCha20-Poly1305AndroidRAG

Licensed under MIT.

Repositorygithub.com/Pranesh-Selvaraj/Enclave

LicenseMIT

ShellTauri v2 (Rust) — desktop + Android

FrontendSvelteKit (static adapter) + Svelte 5

EditorTipTap (ProseMirror)

StorageSQLite + SQLCipher (encrypted at rest, FTS5 + vec0 ANN)

Data modelDocument + Block with fractional indexing

Seed phraseBIP39 12-word mnemonic (@scure/bip39)

Key derivationArgon2id (hash-wasm) → HKDF-SHA256 sync key

EncryptionSQLCipher at rest · XChaCha20-Poly1305 in transit

DiscoverymDNS (_enclave._tcp.local)

TransportWebSocket (tokio-tungstenite), LAN-only

SyncMutual auth (HMAC-SHA256) + full snapshots, doc-level last-write-wins (Rust core)

Vector searchsqlite-vec ANN in the vault file, exact-cosine re-ranked in Rust

EmbeddingsIn-process ONNX (all-MiniLM-L6-v2, offline) or any /v1/embeddings endpoint

AI clientOpenAI-compatible — Ollama, llama.cpp, LM Studio, vLLM, frontier APIs

Markdown I/OHand-rolled HTML→Markdown serializer + marked

CI/CDGitHub Actions — Windows/Linux/macOS bundles + signed Android APK/AAB

PlatformsWindows, Linux, macOS + Android (beta)

Built in the open. Star it, try it, break it.

Enclave is MIT-licensed and developed in public. Feedback, issues, and contributions are genuinely welcome.

Star on GitHub Read the writing More projects