Zero-Knowledge Protocol
A technical deep dive into how EnvGuard physically separates ciphertext from encryption keys to guarantee absolute data privacy.
Client-Side Key Generation
When a user selects an `.env` file, the browser's native Web Crypto API instantly generates a cryptographically secure 256-bit symmetric key. This key exists purely in RAM and is never part of an HTTP request body.
Authenticated Encryption
EnvGuard utilizes AES-256 in Galois/Counter Mode (GCM). GCM provides both data confidentiality and authenticity. An Initialization Vector (IV) is uniquely generated for every single encryption event. If the resulting ciphertext is tampered with in the database, the decryption process will mathematically fail upon retrieval.
URL Hash Architecture
The stroke of zero-knowledge genius lies in URL fragments. When the ciphertext is saved, the server responds with a unique Document ID. The client combines this ID with the raw decryption key inside the URL hash `#`. According to HTTP RFC specifications, browsers never send hash fragments to the server.
gpp_bad Threat Model & Mitigations
Threat 1: Database Breach (Supabase Compromise)
An attacker gains root access to the PostgreSQL database.
Mitigation: The database contains only AES-256-GCM ciphertexts and random IVs. Without the decryption keys (which reside only in the creator's URL), the data is mathematically secure.
Threat 2: Man-in-the-Middle (MITM) Interception
An attacker intercepts the network traffic between the browser and Vercel edges.
Mitigation: Network requests are strictly enforced over TLS 1.3. More importantly, the payload is fully encrypted before it leaves the browser. The attacker intercepts only ciphertext.