Hoodik

Hoodik is a self-hosted storage server that never sees your files. Encryption and decryption happen in the browser, so what reaches the disk is ciphertext, which removes the usual trade of handing a storage provider readable copies of everything you upload.

The backend is Rust on Actix-web and the frontend is Vue 3. Every account gets an Ed25519 signing pair and a hybrid X25519 with ML-KEM-768 wrapping pair, files are encrypted chunk by chunk with AEGIS-128L, and login runs over OPAQUE so the password never crosses the wire. Older RSA-2048 accounts still work and migrate on the next login.

Encryption in the browser normally costs you every feature that depends on the server reading data, and Hoodik works around that.

• Secure search: file names and note contents are tokenized locally and tagged with HMAC under a key the server never holds.
• Encrypted notes: markdown notes written in a WYSIWYG editor are auto-saved, encrypted and searchable like uploaded files.
• Public share links: the link key rides in the URL fragment, so the recipient decrypts locally and the server decrypts nothing.
• Account controls: optional TOTP two-factor per user, plus an admin dashboard for users, sessions and invitations.
• Storage choices: SQLite by default, PostgreSQL through one environment variable, and chunks on local disk or any S3-compatible service.

Deployment is a single container with multi-arch images for amd64, arm64, armv6 and armv7. Keep your private key somewhere safe, because it is the only route back into a forgotten account.