Noctcom is private storage built on zero-knowledge encryption. Your password and
private keys never leave your device, and the server has no technical ability to
read what you store.
What is encrypted client-side:
- File contents — XChaCha20-Poly1305 chunks, key never sent to the server
- File names and folder structure — encrypted with your vault key
- Metadata (mime type, tags) — encrypted with your vault key
- Your email address — only BLAKE2b(email) is stored, so a database dump does
not reveal who you are
- Sharing between contacts — sealed with X25519 crypto_box_seal, with mutual
consent and TOFU pinning of the public key
Features: encrypted vault with in-browser preview (images with zoom, video,
audio, PDF, code, text), drag & drop upload, trash with restore, favourites and
versioning; 2FA via passkeys (WebAuthn) or one-time email code; 12-word BIP39
recovery phrase that restores both the account and the files; multi-device
registration and revocation; real-time sync across devices; encrypted activity
log that is only decrypted in the client. Interface, emails and manual are fully
bilingual (English / Spanish).
Self-hosting is a first-class mode, not a stripped-down build — same features, no
quotas, no plans, no billing UI:
curl -fsSL https://noctcom.com/install.sh | bash
The installer sets up Docker if missing, asks for your domain and issues TLS
automatically; without a domain it runs in LAN mode over HTTPS with an internal
certificate. On Proxmox VE, bash <(curl -fsSL [https://noctcom.com/lxc.sh](https://noctcom.com/lxc.sh))
creates a Debian LXC and provisions everything inside it.
The cryptographic specification and threat model are public in the repository,
so the claim can be verified rather than trusted.
Licensed AGPL-3.0. Note: the project is pre-1.0 and has not undergone an
independent external security audit.
