Horcrux – Distributed, Zero-Trust Secret Manager

44za122 pts1 comments

GitHub - 44za12/horcrux · GitHub

/" data-turbo-transient="true" />

Skip to content

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Search

Clear

Search syntax tips

Provide feedback

--><br>We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

Sign in

/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

44za12

horcrux

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>19 Commits<br>19 Commits

.github/workflows

.github/workflows

cmd/cli

cmd/cli

docs

docs

gui

gui

internal

internal

scripts

scripts

storage

storage

.gitignore

.gitignore

README.md

README.md

go.mod

go.mod

go.sum

go.sum

logo.png

logo.png

View all files

Repository files navigation

Horcrux

Distributed, Zero-Trust Secret Manager

A secret manager that splits your vault across multiple cloud providers using Shamir's Secret Sharing and Reed-Solomon erasure coding — no single point of failure, no single point of compromise.

Features

Password, TOTP, API Key & File Management — Securely store, retrieve, and organize all your secrets.

Distributed Backup — Vault split across up to 7 cloud providers. Need M-of-N to recover — lose a provider, you're still safe.

Incremental Distribution — Content-addressed segments mean only changed data is re-uploaded. GB-scale vaults distribute in seconds.

Touch ID Unlock — Biometric unlock via macOS Keychain. Falls back gracefully to passphrase on Macs without Touch ID.

7 Storage Providers — Local filesystem, Google Drive, Dropbox, S3/MinIO, USB drives, SSH/SFTP, and WebDAV.

Zero-Knowledge — Providers see only opaque encrypted blobs. The vault passphrase never leaves your machine.

Fuzzy Search — Find passwords and TOTP entries with approximate queries.

Import — CSV passwords, 2FAS JSON TOTP exports.

Cross-Platform CLI — Go binary runs on macOS, Linux, and Windows. GUI is macOS-native (Wails + Svelte).

Quick Start

macOS GUI

Download Horcrux.app from Releases and move to /Applications.

Launch, create a passphrase, and start adding passwords.

Add 2+ storage providers under Providers, then Distribute to back up your vault.

CLI (macOS / Linux / Windows)

# Download and install<br>curl -L https://github.com/44za12/horcrux/releases/latest/download/horcrux-darwin-arm64 -o /usr/local/bin/horcrux<br>chmod +x /usr/local/bin/horcrux

# Initialize<br>horcrux init

# Add a password<br>horcrux pass addpass github.com user@email.com mypassword

# Get a password<br>horcrux pass getpass github.com user@email.com

# Add a provider and distribute<br>horcrux providers auth local<br>horcrux providers auth s3 --endpoint s3.amazonaws.com --bucket my-bucket<br>horcrux distribute

# Restore from providers<br>horcrux restore

Cryptography

Layer<br>Algorithm<br>Key

Vault files (at rest)<br>AES-256-GCM<br>Argon2id(passphrase)

Distribution segments<br>AES-256-GCM (deterministic)<br>Random 32-byte DEK

DEK protection<br>Shamir's Secret Sharing over GF(2⁸)<br>M-of-N threshold

Data fault tolerance<br>Reed-Solomon erasure coding<br>M data + N−M parity shards

Passphrase verification<br>PBKDF2 + HMAC-SHA256<br>100k iterations

Project Structure

horcrux/<br>├── cmd/cli/ # CLI application (urfave/cli)<br>├── gui/ # macOS GUI (Wails v2 + Svelte 4)<br>│ ├── app.go # Go backend methods<br>│ └── frontend/src/components/<br>├── docs/ # Documentation<br>├── internal/<br>│ ├── auth/ # Touch ID + Keychain (CGo)<br>│ ├── config/ # Path configuration<br>│ ├── crypto/ # Argon2id + AES-256-GCM<br>│ ├── distribute/ # Distribution engine<br>│ │ ├── distribute.go # Distribute / Restore / GC<br>│ │ ├── segment/ # Content-addressed segments<br>│ │ └── manifest/ # Versioned manifest<br>│ ├── providers/ # Provider config CRUD<br>│ ├── shamir/ # GF(256) Secret Sharing<br>│ └── vault/ # Vault CRUD + chunked file store<br>│ └── filestore/ # Content-addressed file chunks<br>├── storage/ # 7 provider implementations<br>└── scripts/ # Build helpers

Build From Source

# Prerequisites: Go 1.22+, Node 20+, Wails CLI<br>go install github.com/wailsapp/wails/v2/cmd/wails@latest

# CLI<br>go build -o /usr/local/bin/horcrux ./cmd/cli/

# GUI<br>cd gui && wails build -nopackage<br># App bundle at gui/build/bin/Horcrux

License & Contributing

Contributions, issues, and feature requests are welcome.

About

No description, website, or topics provided.

Resources

Readme

Uh oh!

There was an error...

horcrux providers github vault distribute secret

Related Articles