Tuck is a small vault you run on your own server. It keeps your SSH keys, the hosts they open and the odd file you'd rather not leave lying around, and a single download sets up ~/.ssh on whatever machine you happen to be sitting at.
Everything is encrypted in your browser before it's saved, so the server only ever holds ciphertext. It never sees your password, your answers or your keys, and neither does anyone who walks off with its database.
Run it yourself Read the docs See the code
$ docker pull ghcr.io/dimwitlabs/tuck:1
Getting in
Getting in takes a password and then three questions you wrote yourself, answered one at a time. Each answer is part of the key, and each question is sealed with the answer before it, so nobody can even read the next question until the last answer is right.
- Password Your password. •••••••••••• Stretched with Argon2id, 64 MiB
- Question 1 of 3 The street you learned to ride a bike on? •••••••• Unsealed by the password
- Question 2 of 3 What the first cat was really called? Unsealed by answer 1
- Question 3 of 3 Xh3 m8qzrwa ubo gcvp z1s qdkd7k4ef9w? Sealed
Wrong answers are counted on the server. Every fifth one pauses unlocking, first for fifteen minutes, then thirty, then an hour, and after enough of them the account freezes until whoever runs the database lifts it. Someone who learns your password still has a very long night ahead of them.
Setting up a machine
The install tab builds a script from your vault. Run it on a new laptop and your keys land in ~/.ssh/tuck/, your hosts turn into ssh aliases, and one Include line goes at the top of your config. running it again brings the machine up to date. it deletes itself when it's done, since it holds your private keys, and --remove takes everything back out.
$ sh ~/Downloads/tuck-install.sh Tuck installed 2 key(s) and 3 host(s) into /home/you/.ssh/tuck. ssh workshop (also: shop) ssh db-1 ssh inner Deleted /home/you/Downloads/tuck-install.sh, since it held your private keys. $ ssh workshop
The installer only writes SSH options that tune a connection. Anything that could run a command, forward your agent or quietly stand in for a real host like github.com is left out, and the install tab tells you exactly what it skipped.
Running it
Tuck is free and open source under the mit licence, and ships as one Docker image built for both amd64 and arm64. The compose file runs it next to a Postgres that has no network at all, and it expects an HTTPS proxy like nginx in front. If you'd rather use a database you already have, supabase or neon or your own, point it there instead.
$ cp .env.example .env $ docker compose up -d
.env first. the Docs Cover the proxy and your first login.What it can't do
There's no recovery. Forget your password or one of your answers and the vault stays shut for good, so keep the decrypted export somewhere safe.
Tuck is meant to be self-hosted for a reason. Whoever runs the server could change the page it sends you and capture what you type, which is true of every app that encrypts in the browser. And no app can protect you from a computer that's already compromised. What it protects against Goes through all of it.