lance1416/cheesy-toast-vault

🧀 Cheesy Toast Vault

A self-hosted personal password book with client-side encryption. Your vault password never leaves your browser — the server stores only ciphertext.

How it works

Two separate passwords protect your data:

• Login password — authenticates you with the server (bcrypt-hashed, verified by the server)
• Vault password — encrypts your vault entries in the browser (PBKDF2 → AES-256-GCM; the server never sees it)

Losing your vault password means losing your data. By design.

Features

• Multiple named vaults per account
• Per-entry fields: site name, URL, username, email, password, notes, tags
• Password generator (random or passphrase)
• HaveIBeenPwned breach check (k-anonymity — password never sent)
• Stale password detection (flags entries older than 90 days)
• Auto-lock vault after configurable idle timeout
• Light / dark / system colour scheme
• Email verification and password reset via Resend

Self-hosting

Requires Docker and a Resend account (free tier: 3 000 emails/month).

yaml
services:
  app:
    image: lance1416/cheesy-toast-vault:latest
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      # Must match POSTGRES_PASSWORD below
      DATABASE_URL: postgresql://postgres:changeme@db:5432/cheesy_toast_vault
      # Generate with: openssl rand -hex 32
      NEXTAUTH_SECRET: replace-with-openssl-rand-hex-32
      NEXTAUTH_URL: https://yourdomain.com
      RESEND_API_KEY: re_your_resend_api_key
      EMAIL_FROM: Cheesy Toast Vault <noreply@yourdomain.com>
      RESET_BASE_URL: https://yourdomain.com
    depends_on:
      db:
        condition: service_healthy
    networks:
      - internal
  db:
    image: postgres:17-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: changeme
      POSTGRES_DB: cheesy_toast_vault
    volumes:
      - pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 5s
      retries: 10
    networks:
      - internal

volumes:
  pgdata:

networks:
  internal:
    driver: bridge

Copy the docker-compose.yml and replace the placeholder values: