STAKD.ME — Your portfolio. Your keys. Your privacy
Use STAKD instantly at app.stakd.me. Your portfolio is encrypted in the browser before any network request, so the server stores encrypted blobs, never plaintext holdings.
- MIT licensed project
- No email or personal information required
- Use now at app.stakd.me
Core capabilities
Everything shown here is based on the current README and implemented as a privacy-first architecture.
End-to-End Encryption
Portfolio data is encrypted client-side with AES-256-GCM before it leaves your browser.
Zero-Knowledge Design
Server never sees plaintext portfolio data and cannot decrypt your vault.
Anonymous Auth
Sign in with username + passphrase only. No email and no PII collection.
Portfolio Tracking
Track buys, sells, receives, and sends across multiple tokens.
Manual Entries
Add off-chain holdings that are not captured by transactions.
Portfolio History
Store snapshots over time and visualize changes with interactive charts.
Price Feeds
CoinGecko + Binance sources with configurable auto-refresh.
Multi-Language UI (i18n)
Interface available in English, Vietnamese, Spanish, and German.
Security flow
Cryptographic operations happen on the client. The server receives only what it needs for authentication and encrypted storage.
Step 1
Create username + passphrase
No email required. Your passphrase stays on your device.
Step 2
PBKDF2 (SHA-512, 600K)
Derive a master key with high iteration count to resist brute-force attacks.
Step 3
HKDF split
Master key is expanded into auth key and encryption key for separate duties.
Step 4
AES-256-GCM vault encryption
Vault data is encrypted in-browser. Server stores only encrypted blobs and hashes.
Client and server responsibilities
STAKD keeps sensitive processing on the client and keeps server data minimal.
Client
- PBKDF2 with 600K iterations derives a master key from passphrase + salt.
- HKDF splits the master key into auth key and encryption key.
- AES-256-GCM encrypts/decrypts the entire vault blob in the browser.
- Encryption key stays local (sessionStorage), requiring login after tab close.
Server
- Stores only SHA-256 hash of auth key for login verification.
- Stores encrypted vault blob with optimistic concurrency versioning.
- Manages shared price cache/history (CoinGecko + Binance feeds).
- Redis handles rate limiting, refresh debounce, and cache acceleration.
Only shared market prices are plaintext server-side data. User-specific portfolio content remains encrypted.
Tech stack
The stack below mirrors the README and current implementation direction.
Frontend
Next.js 16 (App Router), React 19, TypeScript
Styling
Tailwind CSS
State
Zustand, TanStack React Query
Charts
Chart.js, Recharts
Crypto
Web Crypto API (PBKDF2, HKDF, AES-256-GCM)
Auth
JWT (jose) with httpOnly refresh cookies
Database
PostgreSQL 16 with Drizzle ORM
Cache
Redis 7
Container
Docker Compose
Built-in rebalance strategies
Five strategy modes are described in the README for different portfolio management styles.
Threshold
Rebalance when any token drifts beyond its hold zone.
Calendar
Rebalance on fixed weekly, monthly, or quarterly schedules.
Percent of Portfolio
Trigger actions when total portfolio value changes by a configured percent.
Risk Parity
Allocate inversely by volatility using historical price behavior.
DCA-Weighted
Split rebalance trades into smaller chunks over time.
Quick start
Start in the hosted app, or self-host if you need full infrastructure control.
Use the hosted app
No Docker, no setup, no self-hosting required.
https://app.stakd.me- Open app.stakd.me
- Create account with username + passphrase
- Start tracking portfolio immediately
Optional self-host
Prefer running your own infrastructure? Use Docker Compose from the open-source repo.
git clone https://github.com/stakd-me/stakd.git
cd stakd
cp .env.example .env
# set JWT_SECRET in .env
docker-compose up -dHosted app URL: https://app.stakd.me
FAQ
What is STAKD?
A private cloud crypto portfolio tracker with end-to-end encryption and zero-knowledge architecture.
Is it free and open source?
Yes. STAKD is open source under the MIT license and free to use.
Do I need to self-host?
No. You can use the hosted app directly at app.stakd.me. Self-hosting is optional.
How is data protected?
Data is encrypted client-side using AES-256-GCM. Keys are derived from your passphrase with PBKDF2 + HKDF.
What if I lose my passphrase?
Because of zero-knowledge encryption, passphrase recovery is not possible. Keep it in a password manager.
What license does it use?
MIT license. You can use, modify, and distribute it under MIT terms.
Start using STAKD now
Open app.stakd.me and track your portfolio with zero-knowledge privacy from day one.
Cloud-ready, free to use, and open source under MIT.