Your passwords.
Your servers.
No compromise.
Nokee encrypts everything client-side using AES-256-GCM. The server stores only ciphertext — it never sees your plaintext passwords or encryption keys.
One leaked password can cost millions
Most teams store passwords in spreadsheets, chat messages, or on personal devices — without realizing how much a single breach can cost them.
€4.9M
Average cost of a data breach
IBM 2024
4%
Max GDPR fine of global annual revenue
GDPR Art. 83
277
Days on average to detect a breach
IBM 2024
83%
of companies have experienced more than one breach
IBM 2024
💬 Passwords in Chat & Email
Credentials sent via Slack or email live in message history forever. One compromised account exposes every password ever shared — with no way to revoke access.
📊 Excel & Google Sheets
Spreadsheets are unencrypted on disk and cloud-synced without access control. Version history preserves deleted passwords. A wrong share setting means a mass leak.
📱 Personal Devices
Passwords saved in personal browsers sync to private accounts outside company control. There is no remote wipe when an employee leaves — and no audit trail.
Sources: IBM Cost of a Data Breach Report 2024 · GDPR Art. 83
Why Nokee
Security you can audit,
infrastructure you control
Nokee is built on the principle that your secrets should only ever be accessible to you — cryptographically enforced.
Zero-Knowledge Architecture
The server never sees your plaintext passwords or encryption keys. Everything is encrypted and decrypted exclusively in your browser.
Fully Self-Hosted
Deploy on your own infrastructure with Docker Compose. Your data never leaves your servers — no cloud dependency, no vendor lock-in.
Secure Team Sharing
Share passwords with teammates using RSA public-key encryption. Each recipient gets their own encrypted copy — access is fully revocable.
End-to-End Encrypted
AES-256-GCM for all vault items and folder names. PBKDF2 key derivation. RSA-OAEP for sharing. Encryption throughout the entire stack.
Two-Factor Authentication
Add a second layer of security with TOTP 2FA. Compatible with Google Authenticator, Authy, and any RFC 6238-compliant authenticator app.
Complete Audit Log
Every action logged with timestamps and user context. Know exactly who accessed, modified, or shared what — and when. Full accountability.
How It Works
From zero to secured
in minutes
Nokee is designed to be simple to deploy and impossible to compromise — by design.
Deploy Nokee
Clone the repository, configure your environment, and run docker compose up -d. Nokee is production-ready in under 2 minutes on any server with Docker.
docker compose up -d# Runs PostgreSQL, FastAPI backend, and Next.js frontend
Create Your Vault
Register and set your master password. Your encryption key is derived client-side via PBKDF2 with 100,000 iterations — it never leaves your browser.
PBKDF2(masterPassword) → encryptionKey# authHash sent to server · encryptionKey stays local
Collaborate Securely
Invite teammates to shared folders or projects. Each item is automatically re-encrypted with the recipient's RSA public key. Revoke access anytime.
RSA-OAEP.encrypt(item, recipientPublicKey)# Per-recipient encryption · folder cascade sharing
Encryption Model
Encryption you can
actually audit
Our crypto is not a black box. Here is exactly how Nokee protects your data — step by step.
Encryption Flow
Cryptographic guarantees
Server never sees plaintext
The server only ever receives the authHash (a derivative of your master password, useless for decryption) and encrypted ciphertext.
Encryption key never transmitted
Your encryptionKey is derived client-side via PBKDF2 and stays exclusively in your browser session — it is never sent over the network.
Shared items individually encrypted
When sharing, each recipient gets a separate copy encrypted with their RSA public key. Revoking access is cryptographically enforced.
Code auditable on request
Enterprise customers can request a full code review. The exact PBKDF2, AES-GCM, and RSA-OAEP implementation is available for inspection under NDA.
Self-Hosted
Production-ready
in 3 commands
Nokee ships as a fully containerized stack. No complex setup — just Docker and you are running.
# 1. Extract the package and configure
# 2. Start all services
# 3. Run database migrations
# output
✓ Starting nokee_db ...
✓ Starting nokee_backend ...
✓ Starting nokee_frontend ...
→ Ready at http://localhost:3000
Minimum Requirements
What You Get
- On-premise or managed deployment options
- Full control over backups and data retention
- Air-gapped deployment supported
- PostgreSQL included via Docker Compose
- Scales with your team — no user limits
- HTTPS-ready with reverse proxy support
Ready to secure
your team?
Interested in deploying Nokee for your organization? Reach out and we will help you get set up — from a single team to enterprise scale.
Self-hosted · Zero-knowledge · Enterprise support available