featured project

Enclave

Secure, local-first, zero-knowledge knowledge base for desktop and Android — with encrypted P2P sync over local Wi-Fi and an offline RAG assistant.

No cloud. No servers. No internet required.

View on GitHub All projects

How it works

Enclave is built on three core principles — local-first data ownership, zero-knowledge encryption, and peer-to-peer sync — keeping your knowledge private while making it available across your devices, on or offline.

Local-First

All data lives on your device first. Create, edit, and organize pages fully offline — sync is an enhancement, not a requirement.

Zero-Knowledge Encryption

The vault is encrypted with SQLCipher (AES-256-CBC with HMAC-SHA512) before it touches storage. Keys are derived with Argon2id (64 MiB, 3 iterations, 4 parallelism) from a 12-word BIP39 seed phrase that never leaves your device.

Authenticated P2P Sync

Devices on the same Wi-Fi discover each other via mDNS and sync over WebSocket channels secured with mutual authentication — a challenge-response HMAC-SHA256 handshake over the vault-derived sync key, then every frame sealed with XChaCha20-Poly1305. Wrong-key peers are rejected before any data is exchanged.

Zero Telemetry

The application makes zero outbound network requests beyond the optional AI endpoint you configure. All sync traffic is local-network-only — your notes never touch the internet.

Desktop + Android

Built on Tauri v2 (Rust) for a small footprint and native performance — Windows, Linux, and macOS installers, plus a signed Android beta (.apk/.aab) built in CI from the same SvelteKit frontend and Rust core.

Offline RAG Assistant

Ask questions across your vault with retrieval-augmented generation: an in-database sqlite-vec ANN index inside the encrypted vault file, exact-cosine re-ranking in Rust, and fully offline ONNX embeddings — retrieval never leaves your device.

Editor

A TipTap (ProseMirror) editor wrapped for Svelte 5, with slash-command blocks and markdown round-trip export.

Headings/h1, /h2, /h3

Lists/bullet, /numbered

Task lists/task

Block quotes/quote

Code blocks/code

Callouts/callout

Toggle blocks/toggle

Divider/divider

Bubble menu formattingselection

Command paletteCtrl+K

Markdown exporttoolbar

Vault & security

Your vault is encrypted before it touches persistent storage, and keys are derived from credentials that never leave your device.

First launch — create a vault

A 12-word BIP39 English seed phrase is generated client-side. You must save it — it is the only way to unlock your vault. Re-enter the phrase to confirm, and the encrypted vault is created.

Returning — unlock with the seed phrase

The phrase is validated and run through Argon2id (64 MiB, 3 iterations, 4 parallelism) to derive the 256-bit master key, which decrypts the SQLCipher database.

Zero-trust sync

Peers must prove knowledge of the vault-derived sync key via a challenge-response handshake (HMAC-SHA256) before any data — even the hello — is exchanged. Every frame is then sealed with XChaCha20-Poly1305 (AEAD) under a per-session key; other devices on the Wi-Fi see only challenges and ciphertext.

Key material stays in memory

The seed phrase and derived keys exist only in memory during the session and are never written to disk.

Crypto flow

12-word mnemonic
      │
      ▼
Argon2id(password=mnemonic, salt="enclave-vault-master-key-v1")
      │
      ▼
256-bit master key ────► SQLCipher PRAGMA key (encrypt-at-rest DB)
      │
      └── HKDF-SHA256 ──► sync key ──► peer auth (HMAC-SHA256 proofs)
                                       + transport (XChaCha20-Poly1305)

Tech stack

Every layer is chosen for safety, speed, and simplicity.

RustTauri v2Svelte 5SQLCipherP2P syncXChaCha20-Poly1305AndroidRAG

Repositorygithub.com/Pranesh-Selvaraj/Enclave

LicenseMIT

ShellTauri v2 (Rust) — desktop + Android

FrontendSvelteKit (static adapter) + Svelte 5

EditorTipTap (ProseMirror)

StorageSQLite + SQLCipher (encrypted at rest, FTS5 + vec0 ANN)

Data modelDocument + Block with fractional indexing

Seed phraseBIP39 12-word mnemonic (@scure/bip39)

Key derivationArgon2id (hash-wasm) → HKDF-SHA256 sync key

EncryptionSQLCipher at rest · XChaCha20-Poly1305 in transit

DiscoverymDNS (_enclave._tcp.local)

TransportWebSocket (tokio-tungstenite), LAN-only

SyncMutual auth (HMAC-SHA256) + full snapshots, doc-level last-write-wins (Rust core)

Vector searchsqlite-vec ANN in the vault file, exact-cosine re-ranked in Rust

EmbeddingsIn-process ONNX (all-MiniLM-L6-v2, offline) or any /v1/embeddings endpoint

AI clientOpenAI-compatible — Ollama, llama.cpp, LM Studio, vLLM, frontier APIs

Markdown I/OHand-rolled HTML→Markdown serializer + marked

CI/CDGitHub Actions — Windows/Linux/macOS bundles + signed Android APK/AAB

PlatformsWindows, Linux, macOS + Android (beta)

Back home All projects Read writing