Work01/04Electron.js · React · Cryptography
Auth Sync — Cross-platform authenticator
A desktop SaaS for secure TOTP and vault sharing with full client-side end-to-end encryption — nothing leaves the device unencrypted.
- Role
- Organisation
- Period
- Status
The problem
Team password managers ask you to trust the server. For an authenticator holding TOTP seeds and a shared vault, that trade is unacceptable — a breach of the backend should reveal nothing. The brief was a cross-platform desktop app where secrets are encrypted and decrypted only on the device, while still supporting real-time sync and sharing between people.
The approach
01Encryption that never leaves the client
Vault contents and TOTP seeds are sealed with AES-256-GCM on the device, with RSA-SHA handling key exchange for shared entries. The server stores and relays ciphertext it cannot read — sharing a vault means re-wrapping a key for the recipient, never handing plaintext to the backend.
02Real-time sync over WebSockets
Devices hold a persistent socket so a vault change or a new shared entry lands everywhere immediately. Because the payloads are already ciphertext, the sync layer stays a dumb, fast pipe — no server-side decryption step in the hot path.
03Authentication at the OS layer
Unlocking uses WebAuthn and Windows Hello rather than a re-typed master password, so the platform keychain and biometrics guard the local key material. This keeps the security boundary at the operating system, where it belongs on desktop.
04Release engineering as a first-class concern
Electron Builder produces installers for Windows, Linux and macOS, code-signed on Windows and macOS. GitHub Actions builds and publishes each release to S3, and the app auto-updates from there — so a crypto fix reaches users without asking them to re-download anything.