NodeZero

NodeZero encrypts Gmail end-to-end and keeps your passwords in a vault that no NodeZero server ever sees — all inside a single lightweight browser extension. No account to create. No master password sent to a server. Your identity is a cryptographic key generated on your own device, which only you can unlock. WHY THIS DOES NOT SAY "ZERO-KNOWLEDGE" That phrase describes a company that stores your encrypted data and cannot read it. NodeZero does not store your data at all — there is no NodeZero server in the picture. Encryption happens on your device; the only copy that leaves it is a sealed file in your own Google Drive, which Google cannot open. NodeZero sees nothing because it never receives anything. That is a stronger claim, and an accurate one. BETA NOTICE NodeZero is under active development. While all cryptographic operations use audited libraries and follow established standards, the extension has not yet undergone a formal third-party security audit. Exercise caution: avoid storing credentials you cannot afford to lose without a backup, and always keep your 12-word recovery phrase in a safe place. Report issues at https://nodezero.top/contact. HOW IT WORKS Your vault is encrypted locally before it ever leaves your browser. Each field (username, password, notes) is encrypted individually with AES-256-GCM using a unique nonce — not as a single blob. Your vault has one encryption key, generated at random. Each way you unlock — a hardware authenticator via WebAuthn PRF, a passphrase, or your recovery phrase — holds its own separately encrypted copy of it. Adding or changing an unlock method therefore never re-encrypts your vault, and no copy of the key is stored on any server. Google Drive backup saves your encrypted vault to your own Google Drive appdata folder — a private storage area that only NodeZero can access. The vault is encrypted on your device before upload, so Google stores only ciphertext. No NodeZero server is involved in backup or restore. WHAT MAKES NODEZERO DIFFERENT No email, no phone number, no name. Your identity is a decentralised identifier (DID) derived from your cryptographic keys. There is no "forgot password" flow because there is no account. Recovery uses a 12-word mnemonic phrase — the same proven approach used by cryptocurrency wallets. No NodeZero server ever sees your encryption keys, your plaintext credentials, or your usage patterns. Backups go to your own Google Drive. All cryptographic operations happen locally in your browser. NodeZero is proprietary software. The full licence terms ship inside the extension as LICENSE.txt, alongside the notices for the open-source components it is built with. CREDENTIAL MANAGEMENT - Your Keys Stay On Your Device — Your vault has one encryption key, generated at random on your machine. Each unlock method you add holds its own separately encrypted copy of it: a hardware authenticator via WebAuthn PRF (YubiKey, SoloKeys, Titan, Feitian), a passphrase, or your recovery phrase. No copy of the key is stored on any server. There is deliberately no face or fingerprint unlock: Windows Hello and Touch ID give a browser extension no way to bind a stored key to the scan, so any key it kept would be readable from a copy of the browser profile. Authenticators without PRF use a passphrase instead. - DID-Based Identity — Your vault is owned by a decentralised identifier (did:key) that you control. No email, no phone number, no account required. - Field-Level Encryption — Every sensitive credential field is individually encrypted with AES-256-GCM and a unique IV. Not single-blob encryption. - Google Drive Backup — Back up your encrypted vault to your own Google Drive. The vault is encrypted on your device before upload, so what Google stores is ciphertext, a filename and a size. That holds by design and in normal operation; it is not a guarantee against malware on your own machine, which can read the vault while it is unlocked. Restore on any device by signing in with your Google account and entering your recovery phrase. - One-Click Import — Migrate from Chrome, LastPass, Bitwarden, or 1Password in under 60 seconds with CSV drag-and-drop. Round-trip export is also supported, and two-factor codes travel in both directions wherever the format has a column for them. - Two-Factor (TOTP) Codes — NodeZero holds your 2FA codes beside the passwords they belong to. Enrol by scanning the QR a site shows during its two-factor setup, by pasting a setup key, or by importing them with the rest of your vault. Codes are generated on your device with a live countdown; the seed is encrypted like a password and is never shown outside the editor. Non-standard issuers work too — 8-digit codes, SHA-256, and 60-second periods are read from the setup link rather than assumed. Enrolment finishes only when a code NodeZero generates matches the one the site accepted, so a mis-scan cannot leave you locked out of an account. Worth knowing before you use it: keeping a password and its second factor in one vault is a convenience with a real cost — anyone who opens the vault has both. NodeZero narrows that (the vault is local, and unlock can require a hardware key) but does not remove it. - 12-Word Recovery — A BIP-39 mnemonic phrase restores your logins and any passkeys NodeZero holds, on any device. Shown once during setup, never stored. One limit, stated plainly: in vaults created before NodeZero moved to its current key model, your saved contacts are encrypted under the primary key only and the phrase alone cannot open them — you need the original passkey or passphrase for those. Logins are restored either way, and NodeZero tells you which case you are in during recovery. You can recover a different vault on the same device with a clear warning before overwriting. - Context Menu Fill — Right-click to fill credentials with a domain-matched picker, generate passwords, or save logins. No auto-fill surprises — you choose when and where to fill. - S…