Source code and details: https://github.com/umutcamliyurt/Lethean
Lethean is a zero-knowledge encrypted storage app with no accounts, no email. Your passphrase is the only credential and never leaves the browser. Upload photos and videos, browse them in a gallery, and play them fully decrypted in memory, the server only ever sees ciphertext.
Features
- No user account required
- AES-256-GCM for client-side encryption
- Ciphertext padding to hide file size metadata
- Argon2id for key derivation
- Duress code for wiping the vault under coercion
Access tokens
Browsing a vault requires only its vaultId. Uploading additionally
requires an operator-issued access token (10 GB quota by default),
provisioned server-side.
A freshly issued token binds permanently to the first vault that uploads with it; a bound token cannot be reassigned.
People really need to learn “the cloud” just means “a hard drive someone else owns”…
It’s always weird when people start pushing cloud based apps for privacy/security. Because at the end of the day, you’re handing all your data to some dude you don’t know, along with almost certainly identifiable information.
Sometimes it’s better not to keep sensitive data on your own device in the first place, for example when crossing country borders. With zero-knowledge encryption, nobody except the person who has the encryption key can view the contents of files, so where the data is stored is less important. Lethean’s duress password feature also lets a user nuke their vault if they are under coercion.
The UI, this post, and a lot of the code seems like slop. The last thing I would ever fucking do is upload my files to a vibe-coded cloud service.
I can literally see no reason to use this, personally. Not when better options that are actually audited (or even self hostable) exist.
Give us better self-hostable zero-knowledge cloud storage options if you have them. Proton Drive is partially vibe-coded and as far as I know, there aren’t any truly FOSS zero-knowledge cloud services other than this (Lethean is also self-hostable).
Did you make this? If so, I always find it curious that people like this cannot just take the advice/criticism they asked for.
Zero-knowledge refers to a very specific type of encryption, and it has to work.
Putting faith in anything that was vibecoded for something like zero knowledge encryption seems like a very bad idea.
And yet that specific advice just cannot ever be accepted and brought on. The response is always defensive.
I appreciate that you saw the need for something, and took initiative to try to make it… However, unless you’ve got experience with developing this kind of encryption, and didn’t just offload any of it to an LLM, then I worry it’s doing more harm than good.
In the case of something like this, having no option is better than having an option that confidently tells you it works while you have no idea what’s actually happening under the hood.
I did make this and i understand the codebase well. Using AI to create documentation doesn’t invalidate the quality of my code.
Ok then if that’s the case, you should have clarified that AI wasn’t used in coding the important stuff, but just documentation.
Because I think that’s where most people’s concern was. That is, trusting LLM for a specific type of privacy application.
Thanks for pointing this out
Just use something like tomb instead with any cloud at all
