With a password vault your own server cannot read.
Nexthop manages your servers, your credentials and the rules for who may reach them. It runs as one container on your own hardware. NextVault is the password vault in the same window: entries are encrypted on the client, and the server stores nothing it can read.
Entries are encrypted before they are sent — in the desktop client, in the browser extension and in the web interface alike. The key is derived from a master passphrase that never reaches the server. Each entry is stored as one block of bytes and a revision number: there is no column for a name, a folder or an address. An administrator with full database access reads the same blocks as someone with a stolen copy.
SSH, RDP and SFTP connections live in folders with unlimited nesting. Each entry carries eight separate rights, granted to users or groups and inherited from the folder above. Every entry shows who may access it and which rule granted that access. Anything not explicitly allowed is denied.
Since version 0.1.4 a connection carries the id of a vault entry instead of a secret. The client resolves that id locally at the moment you connect and decrypts it on your machine. That closed the last place where a password passed through the server in the clear.
Store a WireGuard profile in the vault and route any connection through it. The tunnel runs inside the Nexthop process: no driver, no installer, no administrator rights, and nothing left on the machine after you close the window. If the tunnel fails to come up, the connection is not attempted.
Every access is written to a hash chain in which each entry seals the previous one. The database rejects updates and deletes on that table. Denied requests are recorded as well, so repeated attempts to read credentials someone is not allowed to see can be looked up afterwards.
One Docker container and one compose file. It runs as UID 10001 on a read-only filesystem with all capabilities dropped, in a Docker Hardened Image with no shell and no package manager and no known vulnerabilities, and speaks TLS 1.3 only. There is no account with us and no data leaves your network.
On a schedule the server writes the connections as a portable .nxh file and a full snapshot of the database. A passphrase encrypts both with argon2id and AES-256-GCM, and old copies are cleaned up. Without a passphrase no passwords are written into the file at all — better a backup without them than one sitting in the clear on a network share.
Import from Remote Desktop Manager (.rdm) and from the native format (.nxh); the vault reads and writes CSV and an encrypted .nxv file. Stored commands — a title and a command line — are kept per account and follow you to every machine you sign in from.
One licence covers one server with any number of clients and users. Prices in Swiss francs, VAT excluded. Lemon Squeezy is the seller and handles payment and invoicing.
Free, with no limit on installations — the licence applies to the server, not the client. Both connect over HTTPS on port 8443 and show the certificate fingerprint on first use, so you can verify you are talking to your own server.
Download the clients GitHub Releases
Windows reports an unknown publisher on first launch because the executable is not code-signed. Click More info, then Run anyway.
You need a host with Docker and a directory for the data. The two files below are the complete configuration. Read them before you start the container.
The repository holds the compose file and the setup guide. There is no source code in it — the server itself ships as an image.
nexthop-server compose file and guide docker-compose.yml the container
git clone https://github.com/amslertec/nexthop-server.git
cd nexthop-serverIt encrypts every stored secret, and without it the server refuses to start. Do this before the first start.
echo "NEXTHOP_SECRET_KEY=$(openssl rand -base64 32)" > .env
chmod 600 .envThe key encrypts everything the server stores, including the backups. Without it the data cannot be recovered — not by you, not by us, not by the server. There is no reset procedure.
In docker-compose.yml, set NEXTHOP_TLS_HOSTNAMES to every name and address the server will be reached under — they go into the certificate, and a missing one fails every ordinary certificate check. Set TZ as well; the backup schedule runs in local time.
docker compose up -dOpen https://your-address:8443. The first visit creates the administrator account, and after that the setup route is closed for good. Then paste your licence key under Settings → License — until then no client can connect, while the web interface stays fully usable.
| Requirements | Docker with Compose, one port (usually 8443), and a licence key. Nothing else needs installing. |
|---|---|
| Server | One Docker container. UID 10001, read-only filesystem, cap_drop ALL, no-new-privileges. Docker Hardened Image with no shell, no package manager and no known vulnerabilities. |
| Clients | Windows (x86-64) as an installer, Debian and Ubuntu as a .deb. Free, with no limit on installations — the licence applies to the server. Clients never hold a key. |
| Protocols | SSH, SFTP and RDP. SFTP opens with a file browser; RDP uses the built-in Windows client and FreeRDP on Linux. |
| Transport | TLS 1.3 only, port 8443. On first start the server issues its own certificate and writes the fingerprint to the log and to /data/tls/fingerprint.txt — the client asks for it. |
| Account passwords | argon2id, m=64 MiB, t=3. |
| Vault | argon2id derives the key, XChaCha20-Poly1305 encrypts — both in the client, the browser extension or the browser. The server holds no key and never decrypts. |
| Connection secrets | XChaCha20-Poly1305 with a key from the environment, never from source. A connection can point at a vault entry instead, and then the server stores no secret at all. |
| Audit log | Hash chain plus database triggers against updates and deletes. Verifiable at any time with audit-verify. |
| Backups | Scheduled, in local time. argon2id and AES-256-GCM over the whole payload. A .nxh file restorable on any server, plus a full database snapshot. |
| Import and export | Remote Desktop Manager (.rdm) and the native .nxh format. The vault also reads and writes CSV and an encrypted .nxv file. |
| VPN | WireGuard in user space, inside the client process. No driver, no administrator rights, nothing left behind after closing. |
| Breach check | Against Have I Been Pwned by k-anonymity — off by default, and only on request. Your password never leaves the machine. |
| Licence check | Every six hours in the background. Without internet the server keeps running for seven days after the last successful check. |
| Web interface | German and English, light and dark, keyboard shortcuts, usable on a phone. Every view keeps its own address, so a bookmark lands where you left it. |
Clients are refused with 402 Payment Required. The web interface keeps working, so your data, the export and the backups stay reachable while you decide how to continue.
Remove the licence under Settings → License before you tear the old server down; that frees the activation slot. If you forget, the page shows a release code — write it down while the server still runs. It lives in the data volume, and once that is gone the slot stays taken.
Questions about the licence, help with the setup, or something Nexthop cannot do yet — write and you get an answer from the person who built it, usually the same day.