Tech stack & infrastructure

zcrypt is one product across three surfaces: web, desktop, and Android, sharing a single design principle: all encryption happens on your device, and the server only ever handles ciphertext. That principle drives the stack. The backend stays deliberately thin (standard-library Go, no framework), the cryptography lives in code that runs on the client (a Rust core for native, Web Workers for the browser), and the database stores only metadata and encrypted blobs.

A stateless HTTP service written in Go with the standard library only, no web framework, just net/http. It brokers the chunked upload/download API, coordinates the storage adapters, and holds no plaintext and no encryption keys.

The browser client is a Next.js App Router application. The full encryption pipeline runs here in a pool of Web Workers, so compression, encryption, and hashing happen off the main thread: the server never sees a plaintext byte.

Desktop and Android run zcrypt-core, a shared Rust crate that implements the same zero-knowledge crypto and chunk pipeline as the web workers, compiled to native code and embedded in-process, so there is no subprocess. The native shell is Tauri v2.

See Desktop app and Android app for how the shared core reaches each platform.

The cryptographic format is identical across every surface and pinned by conformance vectors, so a file encrypted in one client decrypts in any other.

A PostgreSQL database is the index that ties everything together, users, folders, per-file salts, chunk references, encrypted platform tokens, and shares. It holds no readable file contents and no passphrase. Your actual encrypted bytes never live on zcrypt's infrastructure at all: they go to a storage platform you own.

Deployment is intentionally boring and portable. The backend is a small distroless Docker image that runs on any Linux host; nothing about it is tied to a specific provider, which is the point. You can self-host the exact same image (see Self-hosting).

For how these pieces move data at runtime, read Architecture. To run the whole stack yourself, see Self-hosting, and to build on it, Contributing.