A zero-telemetry self-hosted password manager server. giovium is built for absolute data sovereignty. It pairs state-of-the-art cryptography with strict, legacy-style privacy—meaning zero analytics, zero tracking, and no middleman. Your keys, your hardware, your infrastructure.
Server data is saved in the /data folder. To make your data persistent so it doesn't disappear when a container stops or gets deleted, you need to use a Docker Volume. Volumes are managed by Docker and safely stored outside the container's lifecycle.
During the initial pairing handshake, the server outputs its public key string to the standard output (stdout) and simultaneously writes it to a file named publicKey.txt within the /data directory.
Utilizing this key for out-of-band verification during the first client-server pairing is optional but highly recommended to establish a baseline trust. Once the initial connection is successfully secured, the trust relationship is stored, rendering this manual verification step unnecessary for subsequent sessions.
The server runs on HTTP. It doesn't strictly need to be behind SSL, but if you prefer, you can easily host it behind a reverse proxy like NGINX.
Once paired, all communications are always encrypted and signed internally between the server and clients for maximum security. Even if you host giovium on a public server without any reverse proxy, your data remains completely safe.
Universal Platform Support: Fully supported across all major operating systems, including iOS, Android, macOS, Windows, and Linux.
Unified Codebase: Utilizes a shared codebase across all versions to ensure maximum reliability, consistent behavior, and rapid deployment of updates across platforms.
Optimized Responsiveness: Seamlessly adapts to portrait and landscape orientations on mobile devices and tablets.
Advanced iPad Integration: Native support for iPadOS Split View, maximizing productivity and enabling seamless multitasking workflows.
Low Resource Footprint: Rigorously tested with thousands of entries to ensure a minimal data footprint and blazing-fast UI responsiveness regardless of database size.
Advanced Encryption Standards: Employs top-tier cryptographic primitives for all operations:
Ed25519: Utilized for secure server synchronization signing.
X25519: Employed for server synchronization encryption.
XChaCha20-Poly1305: Deployed for robust local data encryption.
Argon2: Utilized for highly secure password derivation.
HMAC: Applied for standard key derivation protocols.
Hardware-Level Integration: Leverages native device cryptographic functions and incorporates large, unique salts for every operation to guarantee maximum security.
Zero-Knowledge Architecture: Data is strictly encrypted at rest (on disk), in transit, and on the server 100% of the time. The server never possesses your cryptographic keys; even in the event of a total server compromise, user data remains categorically secure.
Double Encryption Routing: Offers an optional secondary encryption layer for highly sensitive individual items.
Just-in-Time Decryption: Individual items remain encrypted in memory and are only unlocked precisely when accessed by the user.
Versatile Server Hosting: Server components are available via Docker containers, Linux binaries, Windows executables, and macOS binaries.
Rapid Deployment: Server infrastructure is highly optimized and can be fully deployed in seconds.
Multi-Server Synchronization: Supports simultaneous synchronization across multiple independent servers.
Instantaneous Data Mirroring: Facilitates highly efficient, real-time data mirroring across all connected clients and servers.
Self-Sufficient Transport Security: Clients and servers autonomously encrypt their connection. There is no reliance on external Certificate Authorities (CAs), and the system remains secure even over standard HTTP or custom ports, granting users the freedom to deploy behind a reverse proxy or entirely standalone.
Intelligent Conflict Resolution: Smart management protocols automatically handle out-of-sync servers and items, permanently preventing data duplication.
Seamless Rebinding: Features simple, secure procedures to rebind a client to an existing server or migrate to a new one without data loss.
Append-Only Versioning: Operates on an immutable, blockchain-style data structure. Data is never permanently deleted; all modifications are appended, allowing users to safely access and revert to previous versions of any item at any time.
Rigorous Consistency Verification: Automatically verifies data consistency during the unlocking process. Users are assured that if the vault unlocks without errors, the data is pristine. Furthermore, the application supports extensive, manual offline verification of all files.
Cryptographic File Hashing: Supports multiple file attachments per item, utilizing built-in hashing verification to ensure absolute file integrity and peace of mind.
Minimalist Design: Features a clean, distraction-free interface with native support for both Light and Dark modes.
Customizable Data Fields: Users can construct dynamic entries utilizing any combination of fields, including standard text, text areas, concealed passwords, Time-based One-Time Passwords (TOTP), and file attachments.
Integrated Authenticator: Supports manual OTP code entry as well as automatic generation via QR code scanning.
High-Performance Search: Features a highly optimized search engine capable of instantly filtering items by exact names or custom tags.
Privacy Controls: Allows users to explicitly hide specific elements or fields from standard view when necessary.
Biometric Authentication: Integrates seamlessly with hardware-backed security modules (e.g., Secure Enclave) for safe, biometric-enabled encryption and decryption.
Intelligent Lock/Unlock: Features smart auto-unlock from the background and customizable automatic lock timeouts to secure the vault when not in active use.
Anti-Espionage Safeguards: Actively blocks screen recording, direct screenshots, background screenshots, and visibility within the OS app switcher.
Strict Ownership Verification: Demands explicit verification of the owner via the master password upon initial login.
Absolute Privacy & Zero Tracking: All data is uniquely yours. There are absolutely no embedded tracking codes, no advertisements, and no third-party error-logging tools. The application strictly limits all network connections exclusively to your configured server.
Absolute Data Ownership: No middlemen, no account creation, and no email recovery loops. Your privacy is absolute, governed entirely by your secure master password.
Offline Accessibility: Encrypted vault files can be securely accessed offline via native file managers (e.g., the iOS Files app) for manual backup management.
Automated Cloud Backups: Seamlessly integrates with iCloud (on iOS) to automatically back up the encrypted application state.