Zero knowledge
Nothing readable reaches the server.
Filenames, file contents, metadata, and keys are encrypted on your machine before upload.
Zero-knowledge sync for developers
Every file.Only yours.
Encrypted file and folder sync that keeps filenames, contents, and keys invisible to the server.
AQT / SYNCLOCAL FIRST
$
aqt sync ~/vaultciphertext pushedThe storage provider is no longer a trusted party.
aqt encrypts locally with XChaCha20-Poly1305. Your root key never leaves your device, and your server only coordinates opaque objects.
Server seesOpaque IDs
Server storesCiphertext
Server cannot readNames or files
You controlEvery key
Built for the whole life of a file.
Push it once, keep a folder in sync, back a repository up, share it safely, or recover it years later.
Content addressed
Sync less. Restore faster.
Folders become a Merkle DAG of encrypted chunks with per-account deduplication.
Private sharing
The key stays after the #.
Public links keep their key after the #. For private account grants, aqt share --with gives read-only access, aqt shares lists incoming grants, and aqt contacts pins recipient keys.
Encrypted Git remotes
Push history, not a .git folder.
Git owns commits, refs, and merges; aqt stores the bundles as ciphertext. Clone, fetch, push, tags, and ref deletion all work through the same binary, and the server never sees a path, a ref, or an object.
Snapshots
Checkpoint what matters.
Anchor named snapshots, compare them with the live tree, and restore in place or beside it.
Terminal UI
The whole vault on one screen.
aqt tui is a lazygit-style dashboard. Live changes, snapshots, and shares, driven by single-key actions that run real aqt commands.
From plaintext to sealed matter.
Blocks converge, encrypt, and move. The network only carries what it cannot understand.
One binary. Three essential moves.
Seal a file in one line.
Private is the default. Add --public only when you intend to share.
AQT SHELLLOCAL
$ aqt push secret.envaqt://7yQ2peencrypted / private / copied
Track folders like git.
Two-way sync that merges non-overlapping text edits and keeps a conflict copy when they collide. Preview any of it with aqt diff, or let aqt watch run it for you.
AQT SHELLLOCAL
$ aqt sync ~/vault --conflicts=merge~ merged notes/plan.mdcontent addressed / deduplicated
Prove the restore works.
Clone on a clean machine or roll a tracked folder back to an anchored checkpoint.
AQT SHELLLOCAL
$ aqt restore pre-releaserestored ~/vaultverified / byte exact
A key hierarchy you can reason about
The secret stops at your machine.
Your inputPassphrase
Memory-hard KDFArgon2id
Unlocks locallyRoot key
Seals every resourceXChaCha20
- Cipher
- XChaCha20-Poly1305, role-separated AADs
- KDF
- Argon2id, calibrated on your device
- Keys
- Derived locally, never transmitted
- Server stores
- Ciphertext and opaque IDs
- Transport
- HTTPS enforced off loopback
- Updates
- Ed25519-signed manifest, verified before install
Share links place the content key in the browser fragment.
https://aqt.sh/x/9fK2qd#k.Hs7nT4...The fragment never appears in the HTTP request.
Own the machine. Or rent one.
aqt-server is a static Go binary backed by SQLite and a ciphertext data directory. Put it behind Caddy, systemd, or Docker.
Accounts are managed from the data directory, not a privileged HTTP surface: inspect one, cap its storage, suspend it, or erase it and sweep its ciphertext, with any file left behind named in the receipt.
Read the deploy guideAQT-SERVERSELF-HOSTED
$ AQT_DATA_DIR=./aqt-data ./bin/aqt-server
$ aqt-server admin accounts quota you@example.com 20GBSQLitePrometheusNative TLSPure Go
Your files are ready to disappear.
From everyone except you.
curl -fsSL https://web.sync.aquitano.me/install.sh | shWindows: iwr -useb https://web.sync.aquitano.me/install.ps1 | iex