Device identity
Each authorized device holds its own protected X25519 identity. Plaintext identity material exists only inside an unlocked session.
Vault 01 / personal secret system
Keys,
not accounts.
Nook is a passwordless, local first, decentralized secrets manager. Your vault is encrypted before it leaves the browser, replicated only through storage you choose, and opened only by identities you authorize.
- Encrypted storage
- Distributed authority
Architecture manifest / 04 layers
A vault architecture with no central keeper.
Sealed root keys
Vault keys are wrapped into per-device cryptographic envelopes, so authorized identities can unlock secrets without central authority service.
Provider-neutral sync
Optional providers transport encrypted vault events. They see ciphertext and storage operations—not the secrets held inside.
Immutable event log
Encrypted changes converge through a content-addressed event history, preserving the order and integrity of your vault.
Cryptographic inventory / 17 primitives