Sleep well, even if your hosting service gets hacked. 🔒

MindooDB is an end-to-end encrypted, offline-first sync database. It lets apps collaborate and sync data without giving servers access to the contents.

Even if someone has full access to your infrastructure — database dumps, backups, logs — all they get is ciphertext.

Your data is encrypted on the client before it ever touches a server. No plaintext. No server-side keys. No trust required.

⚠️ Alpha software: This project is in early development and not yet recommended for production use. APIs may change without notice.

Traditional databases trust the server. If your hosting provider is compromised, your data is exposed. Even "encrypted at rest" solutions decrypt data server-side for queries. MindooDB takes a different approach: encryption keys never leave your clients.

┌──────────────────────────────────────────────────────────────────┐
│                         Your Clients                             │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐               │
│  │   Alice's   │  │    Bob's    │  │  Charlie's  │               │
│  │   Device    │  │   Device    │  │   Device    │               │
│  │ ┌─────────┐ │  │ ┌─────────┐ │  │ ┌─────────┐ │               │
│  │ │  Keys   │ │  │ │  Keys   │ │  │ │  Keys   │ │ ← Keys stay   │
│  │ │(private)│ │  │ │(private)│ │  │ │(private)│ │   on devices  │
│  │ └─────────┘ │  │ └─────────┘ │  │ └─────────┘ │               │
│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘               │
└─────────┼────────────────┼────────────────┼──────────────────────┘
          │ encrypted      │ encrypted      │ encrypted
          ▼                ▼                ▼
┌──────────────────────────────────────────────────────────────────┐
│                     Server (or P2P Peers)                        │
│                                                                  │
│   ┌─────────────────────────────────────────────────────────┐    │
│   │           Encrypted Blobs (unreadable)                  │    │
│   │     🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒             │    │
│   └─────────────────────────────────────────────────────────┘    │
│                                                                  │
│   Server can sync & store data, but CANNOT read it               │
└──────────────────────────────────────────────────────────────────┘

Sync happens through content-addressed stores: clients exchange only the encrypted entries they're missing. Works peer-to-peer, client-server, or any combination - for documents and attached files.

npm install mindoodb

📱 React Native / Expo? See the React Native setup guide for mobile-specific instructions with native performance.

• Use native Automerge (react-native-automerge-generated) and native crypto for production.
• Treat Expo Go / JS fallback as a convenience path for prototyping, not the default production runtime.

import { 
  BaseMindooTenantFactory, 
  InMemoryContentAddressedStoreFactory,
} from "mindoodb";

// 1. Set up storage (in-memory for demo; use file/server-backed for production)
const storeFactory = new InMemoryContentAddressedStoreFactory();
const factory = new BaseMindooTenantFactory(storeFactory);

// 2. Create tenant (generates all keys, opens tenant, registers user — single call)
const { tenant, adminUser, appUser, keyBag } = await factory.createTenant({
  tenantId: "acme-corp",
  adminName: "cn=admin/o=acme",
  adminPassword: "admin-password",
  userName: "cn=alice/o=acme",
  userPassword: "user-password",
});

// 3. Open a database and create documents
const db = await tenant.openDB("contacts");
const doc = await db.createDocument();

await db.changeDoc(doc, async (d) => {
  const data = d.getData();
  data.name = "John Doe";
  data.email = "john@example.com";
});

// 4. Read it back
const contacts = await db.getAllDocumentIds();
const loaded = await db.getDocument(contacts[0]);
console.log(loaded.getData()); // { name: "John Doe", email: "john@example.com" }

// Alice creates a document
const aliceDB = await aliceTenant.openDB("projects");
const project = await aliceDB.createDocument();
await aliceDB.changeDoc(project, (d) => { d.getData().title = "Secret Project"; });

// Bob pulls Alice's changes
const bobDB = await bobTenant.openDB("projects");
await bobDB.pullChangesFrom(aliceDB.getStore());

// Bob edits the document
const projectDoc = await bobDB.getDocument(project.id);
await bobDB.changeDoc(projectDoc, (d) => { d.getData().status = "In Progress"; });

// Alice pulls Bob's changes
await aliceDB.pullChangesFrom(bobDB.getStore());
// Alice now sees: { title: "Secret Project", status: "In Progress" }

An organization or team that shares access. Created client-side—no server registration needed.

• Has a default encryption key (a regular KeyBag key shared with all members)
• Has an admin key (for registering/revoking users)
• Contains multiple databases

Identified by cryptographic key pairs, registered by an admin:

• Signing key (Ed25519): Proves authorship of changes
• Encryption key (RSA-OAEP): Protects local key storage
• Keys generated locally; only public keys shared with admin

Each tenant can have multiple databases, created on-demand:

const contacts = await tenant.openDB("contacts");
const invoices = await tenant.openDB("invoices");

A special directory database stores user registrations (admin-only).

Automerge CRDTs with full history:

• Every change is signed and encrypted
• Automatic conflict resolution for concurrent edits
• Time travel: reconstruct any historical state of documents (e.g. run queries on historic data) — see Time Travel Documentation

Files attached to documents:

• Chunked (256KB) and encrypted
• Streaming upload/download for large files
• Deduplication across the tenant

See: Attachments Documentation

MindooDB provides a flexible, incremental indexing facility:

• Cursor-based processing: Only index documents that changed since the last run—no full rescans
• Pluggable indexers: Add any indexer you need (fulltext search, aggregations, custom queries)
• Built-in Virtual Views: Spreadsheet-like views that categorize, sort, and aggregate documents
• Cross-boundary queries: Virtual Views can span multiple databases, mix local and remote data, or even query across tenants

// Incremental indexing: process only what's new
let cursor = null;
while (true) {
  for await (const { doc, cursor: newCursor } of db.iterateChangesSince(cursor)) {
    if (doc.isDeleted()) {
      mySearchIndex.remove(doc.getId());
    } else {
      mySearchIndex.update(doc);  // Flexsearch, Lunr, or custom
    }
    cursor = newCursor;
  }
  await sleep(1000);
}

All encryption keys are stored in the KeyBag—a local, password-protected key store.

Keys are distributed offline (e.g. password protected via email or a shared drive). The default key is typically shared during onboarding; named keys are shared as needed for specific documents.

• Signatures: Ed25519 on every change - proves who wrote it
• Encryption: AES-256-GCM - servers see only ciphertext
• Integrity: Changes are hash-chained - tampering breaks the chain

Revoked users:

• ❌ Cannot sync with peers or servers
• ❌ Cannot make new changes (signatures rejected)
• ⚠️ Can currently read previously-synced local data (planned: data wipe on first connect after revocation)

MindooDB includes revocation timestamp protection to prevent backdated changes from revoked users. See: Revocation Protection

Append-only storage means nothing is ever deleted:

• Complete history of who changed what and when
• Cryptographic proof of all operations
• GDPR compliance via purgeDocHistory() when legally required

• ✅ Node.js - Server-side and desktop apps
• ✅ Web Browsers - Progressive web apps with Web Crypto API
• ✅ React Native / Expo - iOS and Android with native Automerge (Rust via JSI)
• ✅ Electron - Cross-platform desktop apps

• Multi-Tenant SaaS: Each customer isolated with encrypted data
• Collaborative Editing: Real-time co-editing with signed changes
• Secure File Sharing: Named keys for need-to-know access
• Audit-Critical Systems: Tamperproof history meets compliance requirements
• Offline-First Apps: Full functionality without network; sync when connected
• Mobile Apps: End-to-end encrypted sync with native performance

See: Use Cases Documentation

• Getting Started — Fast setup for Node.js, Web, and React Native
• Example Snippets — Copy-paste Todo starters for all runtimes
• Architecture Specification — Full technical details
• React Native Guide — Native Automerge setup and troubleshooting
• Virtual Views — Aggregations and cross-database views
• Data Indexing — Incremental indexing and search integration
• Time Travel — Historical document retrieval and history traversal
• P2P Sync — Peer-to-peer synchronization
• Attachments — File storage and streaming

Run tests from the command line:

# Node.js unit/integration tests (Jest)
npm test

# Install Chromium once for browser tests
npm run test:browser:install

# Real browser runtime tests (Playwright + headless Chromium)
npm run test:browser

# Run Node + browser lanes
npm run test:all

• Browser tests run in headless Chromium and execute MindooDB browser code in a real page runtime.
• During test setup, an ephemeral HTTP server is started automatically and exposes the real sync endpoints.
• Sync assertions use real HTTP requests against that temporary endpoint (no mocked transport for sync tests).
• The server binds to an OS-assigned free port and is shut down after the suite completes.

• The package exports and core API shape are aligned across Node.js, browser, and React Native entrypoints.
• Node and browser now have executable CLI lanes with runtime validation.
• React Native coverage is currently adapter-focused in Jest and does not yet validate full app-level behavior inside a real React Native runtime.
• For high confidence in three-environment parity, add a React Native integration lane (Expo/Detox or RN test app) that exercises document lifecycle, sync, and virtual view updates on device/simulator.
• For Expo Go / JS fallback scenarios, PBKDF2 iterations can be tuned at runtime; native RN builds should keep strong defaults.

Need commercial support, have questions, or want to request a feature? We're here to help! :-)

• 🐛 Bug Reports: Open an issue on GitHub
• 💬 Questions & Discussions: GitHub Discussions
• ✨ Feature Requests: Create a feature request

Apache 2.0

Mindoo GmbH

Your data. Your keys. Your control. With MindooDB, even a complete server breach doesn't expose your documents. Sleep well! 😴🔒