Install
noy-db is an encrypted, offline-first document store: your data is encrypted on the client before it ever reaches a storage backend, so no server or disk you use has to be trusted with your plaintext — a property called zero-knowledge (the store keeps zero knowledge of the data it's holding). @noy-db/hub is the single package that gives you this: install it and you have a working, encrypted database instance in two lines of code.
Scaffold a project (recommended)
One command, one question:
npm create noy-db@latest
pnpm create noy-db
Run in an empty directory, the wizard asks "Use the recommended setup?" — yes scaffolds the minimal template: @noy-db/hub plus browser storage (to-browser-idb), one main.ts, nothing else. Answer no (or pass any explicit flag) and the full prompts open: Nuxt 4 + Pinia, Vite + Vue 3 + Pinia, Vite + TypeScript, or Electron + Vue 3, with a storage adapter, sample data and a sync target. Run inside an existing Nuxt 4 project, it detects your nuxt.config and offers to patch it in place, showing a diff before writing anything. Nothing is installed automatically; the closing lines print the cd / install / dev steps.
Every scaffolded project carries the noy-db command line (from create-noy-db, since 0.10.0-pre.1). Two of its verbs are the rest of the first hour:
noy-db doctor # what is configured, what is missing, what to do about it
noy-db add --list # every store, framework binding, unlock method and export, by layer
noy-db add to-aws-s3 # install one, wire it where a config can be edited, and read the trust line it crosses
doctor needs no secret and prints stable check ids (NOY-S… secret, NOY-R… recovery, NOY-T… topology) so a CI step can gate on --mode=prod --fail-level=warn. add prints, for every package, what its layer does to your trust boundary — a to-* store sees ciphertext only, an as-* export sees plaintext by design, an at-* provider lets a host you control decrypt a slice — because the prefix is the only tell. The full command list is on Command-line tools.
Add the library manually
Prefer to wire things up yourself, or aren't using Nuxt? Add the core library directly:
pnpm add @noy-db/hub
A storage backend is optional to get started — @noy-db/hub ships a built-in in-memory default, so there's nothing else to install for a first run:
import { createNoydb } from '@noy-db/hub'
const db = await createNoydb({ user: 'me', secret: 'correct horse battery staple' })
// in-memory, encrypted, zero-knowledge — no store package required
createNoydb() resolves that in-memory default whenever store is omitted. It's the same shape as @noy-db/to-memory, just built in — fine for a first run, tests, and prototypes. When you need data to persist, pass an explicit store — to-file for local disk, to-browser-idb for the browser, or any other backend from the to-* family (see Core 05 — Stores).
Zero-knowledge encryption is always on
This holds no matter which store you pick: the store never sees plaintext. Your secret (the secret above) derives a key that encrypts every record before it reaches the store; the store is handed ciphertext envelopes and hands ciphertext envelopes back — it can't run your queries or read your data. That's the mechanism behind "zero-knowledge": the party holding the bytes never holds the key.
createNoydb() requires a secret (or a getKeyring callback for custom unlock flows) up front — encryption can't be switched off by omission, only explicitly with encrypt: false (testing only, no privacy guarantee). The full key hierarchy and envelope format are covered in Core 02 — Enclave — and See the ciphertext lets you verify the property on disk in one minute.