Building a zero-knowledge vault in the browser with WebCrypto (no crypto libraries)

At work I built an internal tool for our team's hardware inventory, service logins, environment variables and vendor bills. Because it holds credentials, I gave it one hard rule: the database must never see plaintext. Not the passwords, not the titles, not even which services we use. The whole encryption layer runs in the browser on the built-in WebCrypto API, with no third-party crypto libraries. This post walks through the design and the real code, trimmed for length. The shape of i