ittto
A Django “life OS” (tasks, notes, budget, files and an end-to-end encrypted password vault) so you stop paying for four separate subscriptions.
What it solves
- Five tools that are normally four or five subscriptions (tasks, notes, budget, files, passwords) under one account.
- The vault encrypts with AES-256 in the browser: the server stores secrets it cannot read.
- Multi-currency budgeting across 30 currencies with configurable periods.
- Trilingual by design (Spanish, English, Brazilian Portuguese), not bolted on afterwards.
Most people who organise their life digitally end up paying for four services: one for tasks, one for notes, one for personal finances, one for passwords. Four subscriptions, four companies each holding a different slice of your life, and nowhere they’re visible together.
ittto is the answer to that question: what if it were one account?
The modules
Home. The entry panel: active budget, priority tasks and recent notes on one screen. It’s the only thing most people look at most days.
Tasks. Type, Enter, move on. No dialogs, no six-field form to jot down “call the dentist”. Priority, date and category are there when you need them, not as a requirement for creating the task.
Notes. A plain Markdown editor with autosave as you type, full-text search and tag based organisation.
Budget. Income and expenses by category, with a configurable period and support for 30 currencies. Living across currencies is more common than most of these tools assume.
Vault. A password manager with zero-knowledge AES-256 encryption: secrets are encrypted in the browser before they leave. The server stores something it cannot read, and neither can I.
Drive. Self-hosted file storage, so documents live alongside everything else instead of in a fifth account.
The underlying technical decision
Zero-knowledge isn’t a marketing flourish here, it’s what defines the architecture. If the server can’t decrypt the vault, then all the cryptography has to happen client-side and keys can never travel. That constrains the design of everything else: account recovery, master-password changes, syncing. It’s considerably harder than storing secrets encrypted on the server with a key that’s also on the server, which is what plenty of tools calling themselves “encrypted” actually do, but it’s the only honest version.
How it’s built
Django 5.1 with PostgreSQL, and HTMX on the front end instead of a JavaScript
framework: for an application like this, server-rendered HTML with partial updates gives
the feel of an app without dragging in the weight and complexity of an SPA. There’s
django-axes against brute-force attempts, pyotp for two-factor authentication with QR
codes, and APScheduler for scheduled jobs. Deployed on Railway behind a strict content
security policy.
All three languages (Spanish, English and Brazilian Portuguese) live in Django’s translation infrastructure from the start rather than being added later.
Currently in invite-only closed beta.