OtterSeal Documentation

🦦 Zero-knowledge encrypted notes and secrets

👉 Try it now: Open OtterSeal Web App

What is OtterSeal?

OtterSeal is a suite of packages for building zero-knowledge encrypted applications:

• @otterseal/core — Cryptography library (AES-256-GCM + HKDF)
• @otterseal/cli — Command-line tool for notes and secrets
• @otterseal/rest-api — Backend API for self-hosting

All encryption happens client-side. The server never sees your plaintext content or encryption keys.

Quick Start

Using the CLI

# Create a secret
oseal secret send "This is secret"

# Read your notes
oseal note read "my-title"

Using the Core Library

import { deriveKey, encryptNote } from '@otterseal/core'

const key = await deriveKey('my-title')
const encrypted = await encryptNote('secret content', key)

Self-Host the API

# See: @otterseal/rest-api deployment guide

Architecture

┌───────────────────────────┐
│   Client (Browser/CLI)    │
├───────────────────────────┤
│ @otterseal/core           │
│ • Web Crypto API          │
│ • HKDF key derivation     │
│ • AES-256-GCM encryption  │
└────────────┬──────────────┘
             │ (encrypted)
             ↓
      ┌──────────────┐
      │  REST API /  │
      │  WebSockets  │
      └──────┬───────┘
             │
      ┌──────────────┐
      │   Database   │
      │ (encrypted)  │
      └──────────────┘

Security First

• ✅ Web Crypto API — Uses native browser cryptography (SubtleCrypto)
• ✅ Client-side encryption — Keys never leave your device
• ✅ AES-256-GCM — Industry-standard authenticated encryption
• ✅ HKDF — Cryptographic key derivation with domain separation
• ✅ No passwords — Titles are used directly (more convenient, same security)
• ✅ HashRouter Security — Secret links use URL fragments (/#/send/...) so keys/UUIDs are never sent to the server
• ✅ Open source — Audit the code yourself

Credits & Inspiration

OtterSeal was inspired by the simplicity of publicnote.com, aimed at bringing that same ease-of-use to a zero-knowledge encrypted environment.

Packages

TIP

Each package is independent and can be used standalone or together.

• Core — Cryptography library with AES-256-GCM and HKDF
• CLI — Command-line tool for managing notes and creating secret links
• REST API — Backend API for self-hosting with WebSocket support

Need Help?

• Read the guides on GitHub
• View on GitHub

---

Ready to try OtterSeal? 👉 Go to Web App

Built with ❤️ by JBot