HTML Vault

htmlvault.app

Your artifacts, addressed by their contents.

Push sealed HTML Capsules and Bundles here. Keep them private, publish them, or send them to someone. Every artifact is stored by its own SHA-256 digest, served back byte-identically, and carries a verification verdict you can re-check yourself — offline, in any browser, without trusting this site.

Open your library

What makes this different

Verified on the way in

Uploads are checked against the Capsule spec before they are stored — the integrity seal is recomputed using the recipe the artifact's own spec_version selects. A capsule on a line we don't implement is recorded as unsupported recipe, never as tampering.

Content-addressed storage

Objects live at objects/sha256/… — the same layout as the desktop vault. Identical bytes are stored once. The address is the integrity check for transport.

Sharing is a transfer, not a permission

Sending to another account drops the artifact into their quarantine. They choose whether to accept it into their library — the same custody model the desktop app uses.

The public tier is mirrorable

Public artifacts are published as a static registry index with both digests per entry. Copy it, serve it anywhere, verify it identically. You can walk away from this host.

Two integrity layers, on purpose

The object digest protects the exact bytes we serve; the capsule seal protects what the artifact means (its manifest and data). They are deliberately different: the seal survives re-rendering and re-wrapping, so it cannot see a change to the rendered surface — and the digest catches any change at all, so it cannot tell a meaningful edit from a harmless one. Each catches exactly what the other ignores, which is why every record carries both and every verification checks both.