Phishing-resistant passkey provider with E2EE vault sharing and on-premises deployment.
Zero-knowledge E2EE sharing across organizational boundaries
01 / Context
Password manager targeting enterprise clients who need full data sovereignty - passkeys instead of passwords, E2EE vault sharing, and the ability to run entirely on-premises.
02 / The Problem
Most password managers cannot do passkeys natively or require cloud infrastructure. Enterprise clients in regulated industries need on-premises deployment with no vendor data access.
03 / Key Decisions & Tradeoffs
Chosen
Raw Web Crypto API
Alternative
SimpleWebAuthn or similar
Rationale
Enterprise security requirement - every cryptographic operation needed to be auditable with no black-box dependencies.
Chosen
Node.js compiled to self-contained executable
Alternative
Docker image
Rationale
Clients in regulated industries cannot allow source code exposure or a Docker daemon on their systems.
04 / Hard Parts
Implementing the full WebAuthn attestation and assertion ceremony with the native Web Crypto API (no library shortcuts). Compiling the Node.js server into a single self-contained binary. Extending E2EE sharing to external recipients while preserving zero-knowledge guarantees.
05 / Outcome
Phishing-resistant passkey provider, single-binary on-premises deployment, E2EE vault sharing to any external recipient via email.
Tech Stack
Full walkthrough available on request — reach out.