SECURITY • MAY 2026

Zero-Knowledge Architecture via HKDF.

When we say NitroIDE is a "Zero-Knowledge" platform, we mean it mathematically. We encrypt your local files (OPFS), your WebRTC video streams, and your remote collaborative syncs. However, requiring a user to manage and paste 3 different 256-bit AES keys is terrible UX. Users just want to type a single password.

We solve this by utilizing the Web Crypto API to implement an advanced cryptographic pipeline combining PBKDF2 (Password-Based Key Derivation Function 2) and HKDF (HMAC-based Extract-and-Expand Key Derivation Function).

The Extraction and Expansion Pipeline

When you enter your master password, we first run it through 100,000 rounds of PBKDF2 with a high-entropy salt to protect against brute-force dictionary attacks. This produces a "Master Key Material." We then feed this material into HKDF to mathematically "expand" it into distinct, mathematically isolated sub-keys.

// Deriving mathematically isolated sub-keys from a single master key
const deriveSessionKeys = async (masterKeyMaterial) => {
  // Derive a key specifically and ONLY for OPFS File Encryption
  const fileKey = await crypto.subtle.deriveKey(
    { name: 'HKDF', hash: 'SHA-256', salt: opfsSalt, info: encoder('file-encryption') },
    masterKeyMaterial,
    { name: 'AES-GCM', length: 256 },
    false, ['encrypt', 'decrypt']
  );

  // Derive a completely different key for WebRTC Data Channel Sync
  const syncKey = await crypto.subtle.deriveKey(
    { name: 'HKDF', hash: 'SHA-256', salt: syncSalt, info: encoder('webrtc-sync') },
    masterKeyMaterial,
    { name: 'AES-GCM', length: 256 },
    false, ['encrypt', 'decrypt']
  );
};

Cryptographic Isolation: The beauty of HKDF is isolation. If a highly sophisticated attacker somehow manages to compromise your syncKey via a WebRTC side-channel attack, they cannot mathematically reverse-engineer the masterKeyMaterial, nor can they deduce the fileKey to read your local hard drive.

Client-Side Only

This entire process executes strictly within the V8 engine on your local machine. The server never receives your password, your master key, or your sub-keys. We mathematically cannot read your data, even if served a subpoena.

Code with Absolute Privacy.

Set a master password and experience true Zero-Knowledge engineering.

Launch Secure IDE