Cryptora
A self-hosted vault for passwords, private notes, and important dates. Layered field-level encryption, instant remote logout for any device, and one production migration that swapped the entire encryption scheme without losing a single record.
The problem Cryptora solves.
Most password managers want you to trust a company you've never met with your most sensitive data. Cryptora flips that — you run your own server, your own database, hold your own keys. No third party in the loop at all.
It's three modules under one admin login: passwords, rich-text notes, and important dates. There's also a real session panel that lists every device currently logged in and lets you kill any of them on the spot.
The part worth actually looking at is the execution, not the pitch. Plaintext never touches the database. I ran a real security audit against my own app and fixed everything it flagged. And I migrated the whole encryption scheme in production — live, zero downtime, nothing lost.
End-to-end ownership.
I built Cryptora start to finish — the layered field-level encryption, a live production migration off a custom cipher onto AES-256-GCM with zero downtime, and a full frontend rebuild I planned out in writing before touching any code.
Layered encryption pipeline: field-level AES-256-GCM, signed-token wrapping, encrypted transport
Ran a real security audit against the finished app and fixed every critical/high/medium/low finding
Zero-downtime production migration off a legacy cipher with try-new-then-fallback-to-legacy decoding
Session security: JWT + live MongoDB session records enabling instant remote device logout
Planned and executed a full frontend rebuild with a written, phase-by-phase roadmap and a no-regression checklist
Tools of choice.
What makes Cryptora different.
Layered Field Encryption
Every sensitive value is individually encrypted with AES-256-GCM before it ever reaches the database — plaintext never touches disk.
In-Memory Password Reveal
Decoded passwords pass through router navigation state only — refresh the page and the plaintext is gone, never stored in browser storage.
Live Session Management
See every device logged in with browser, OS, IP, and last activity — and revoke any one of them instantly, mid-session.
Real-Time Multi-Device Sync
Log in on a new device and every other open session gets notified instantly via Server-Sent Events — no refresh needed.
Auto-Saving Rich Notes
A full TinyMCE editor with search, PDF export, and debounced auto-save that correctly handles fast typing during an in-flight save.
Module-Restricted Accounts
Beyond the super admin, module-specific logins (passwords-only, notes-only, dates-only) enforced server-side on every route.
What it achieved.
“Most people run a security audit and quietly fix the embarrassing stuff. Fixing every finding, including the annoying ones, and then migrating the cipher live without downtime — that's the part that's hard to fake.”
Like what you see?
Check out more of my work, or just reach out if you want to talk about a project.