Your secrets, locked by who you are — not what you remember.
🔗 Live App: https://shhh.episodicstack.com (previously at https://shhh-puce.vercel.app)
Shhh is a zero-knowledge, passwordless secrets vault built for people who are tired of remembering passwords. Instead of a master password that can be forgotten, stolen, or guessed, Shhh uses modern identity standards to verify who you are — and then lets you access your vault instantly.
Whether you need to store login credentials, API keys, payment cards, Wi-Fi passwords, bank details, or secure notes, Shhh keeps them all encrypted and organized in one beautiful, easy-to-use interface.
Shhh employs state-of-the-art security mechanisms to protect your data. It uses Envelope Encryption with Data Encryption Keys (DEK) to ensure your payloads are securely encrypted. Sensitive endpoints are protected by rate limiting to prevent brute-force attacks.
Full Role-Based Access Control (RBAC) with user, admin, supervisor, and viewer roles. Admins have access to a dedicated dashboard to view system statistics, manage user accounts, lock/unlock users, and enforce global MFA requirements.
No master password to forget, leak, or get phished. Sign in with your Google account and you're in — frictionless and secure.
Full support for English and Arabic (including RTL layout), with the ability to switch languages on the fly.
Enjoy a polished experience in both light and dark themes, adapting to your system preference or your manual choice.
Shhh supports a wide variety of secret types out of the box:
| Secret Type | Description |
|---|---|
| 🔐 Password | Login credentials for websites and apps |
| 💳 Payment Card | Credit, debit, and prepaid card details |
| 🔧 Environment Variable | API keys and environment configuration |
| 🗝️ API Key | Service API keys and access tokens |
| 📋 License Key | Software and subscription license keys |
| 🪪 Identity Document | Passports, IDs, and travel documents |
| 🏦 Bank Account | Bank account and financial details |
| 📝 Secure Note | Encrypted private notes and text |
| 📶 Wi-Fi Credential | Network names and wireless passwords |
- Search across all your secrets instantly
- Filter secrets by type
- Mark secrets as Favourites for quick access
- Assign custom Tags for flexible organization
Developers can import .env files directly into the vault and export secrets back as .env files — saving time and reducing copy-paste errors.
Get instant email alerts when sensitive secrets are accessed or important account events occur, so you always stay informed.
Enable MFA on your account using an authenticator app for an added layer of protection when accessing sensitive secrets.
Your vault automatically locks after 60 minutes of inactivity. If you step away and forget, Shhh has your back.
Delete individual secrets, clear your entire vault, or permanently delete your account — all from within the app. Your data is yours, and you can remove it any time.
| Language | Status |
|---|---|
| English | ✅ Fully supported |
| Arabic (عربي) | ✅ Fully supported (RTL) |
- Next.js 16 — React framework for production
- React 19 — UI library
- Tailwind CSS v4 — Utility-first styling
- next-auth — Authentication with Google OAuth
- next-intl — Internationalization
- Drizzle ORM — Type-safe database access
- Zod — Runtime schema validation
- React Hook Form — Performant form handling
- otplib — TOTP-based MFA
- Shadcn/UI & Base UI — Accessible component primitives
- Sonner — Toast notifications
- Lucide React — Icon set
- Node.js 18+
- A PostgreSQL database
- A Google OAuth application
# 1. Clone the repository
git clone https://github.com/ZaidAR49/shhh.git
cd shhh
# 2. Install dependencies
npm install
# 3. Copy the environment template and fill in your values
cp .env.example .env.local
# 4. Run database migrations
npx drizzle-kit push
# 5. Start the development server
npm run devOpen http://localhost:3000 in your browser.
Contributions, issues, and feature requests are welcome! Feel free to open an issue or submit a pull request.
Have a question or need support? Use the Contact page on the live app.
Made with ❤️ — Shhh, keep it secret.