Stored values are encrypted at rest.
HushVault uses AES-256-GCM envelope encryption. A data encryption key encrypts each secret value; a deployment master key wraps those data keys.
Security starts with a clear trust boundary.
Read what HushVault encrypts, where the keys live, and what has not been independently verified.
HushVault is not production-ready and has not had an independent security audit. Use test values while evaluating. The private source is not available for public review.
The server holds the master key.
The server decrypts stored secrets when it needs to serve them. HushVault is therefore not zero-knowledge for stored secrets. This supports CLI retrieval and sync, and places the deployment in the trust boundary.
Share links use a different model.
The link secret is encrypted in the creator’s browser and decrypted in the recipient’s browser. The server does not receive the share key.
Self-hosting is not publicly available.
The repository is private and the current deployment notes are account-specific. A public source package, portable guide, and clean-account verification would be needed before offering self-hosting.
Read current self-hosting status