nestegg.money
A private, zero-knowledge net worth & salary tracker.
Encrypted in your browser. No email, no password, just an account number.
Live app
Screenshots
Overview
A deliberately simple, zero-knowledge personal ledger. Single Cloudflare Worker
serving a static frontend (no framework, no bundler) plus three small API
routes, with D1 for storage. Login is a Mullvad-style account number; data is
encrypted in your browser before it's sent, so the server only ever stores
ciphertext.
What it does
- Over time: a stacked bar chart of net worth per year, one colour per
asset (or category), with a net-worth line when liabilities exist.
- Allocation: a donut of your most recent year.
- Entry: tap a year to open its editor; each row is one asset (name,
currency, value). Add/remove assets, copy the previous year, rename the year.
- Categories: assets can be tagged into a category (e.g. several holdings
under "Stocks"). The editor shows each category as a section with a
subtotal; charts roll a category up into one segment.
- Long-term assets & loans: a car or house can depreciate/appreciate
continuously and carry a loan with a real amortization schedule — extra
payments, rate-fixed periods, payment-or-term entry. Its net value is
injected into every year you own it.
- Multi-currency: each row carries its own currency; everything is shown
in your chosen display currency at ECB rates (
/api/fx). Past years use
that year's year-end rates.
- Ticker/crypto rows: shares × live price via
/api/price (Yahoo proxy).
Past years freeze to that year's closing price. Only the public symbol is
sent upstream — never an account or user identifier.
- Salary: monthly pay per person (gross or net — your choice), with events (raises, job changes),
a dual-axis chart, and paste-from-spreadsheet import.
- Budget: a rough monthly "what's left" — income from your latest salary
month, loan payments pulled from your assets, recurring expenses you enter,
grouped into categories with a breakdown donut.
- Forecast & retirement: project net worth forward (contributions,
growth, scenario band, FIRE goal) and simulate drawdown with a state
pension (flat amount or German Rentenpunkte).
- Sync: zero-knowledge. The account number derives an account hash (the
only thing the server sees) and an AES-GCM key (never leaves the browser).
Multi-device edits merge per record with tombstones, newest wins.
No recovery — keep the number safe; Export JSON is the real backup.
- Share links: publish a frozen, read-only snapshot of chosen sections for
an advisor. Each share gets its own AES-GCM key, carried only in the URL
fragment; the server stores an unlinkable id + ciphertext. Expires in 30
days, revocable any time.
- Bilingual: English and German throughout — the app (language picker in
the profile), the landing pages (
/ and /de/), and a public
Brutto-Netto-Rechner
(English version)
that runs the exact salary engine entirely in the browser.
Layout
nestegg.money/
├── src/ # the Worker: /api/fx, /api/price, /api/vault, /api/share,
│ # /api/calc/*, /mcp, /.well-known/mcp.json + page routing
├── public/
│ ├── index.html # marketing landing (generated; German at de/, see scripts/)
│ ├── dashboard.html # the app — loads one <script type="module" src="js/main.js">
│ ├── brutto-netto-rechner.html # public net-salary calculator (client-side, per-locale)
│ ├── i18n/ # runtime dictionaries (en, de)
│ ├── lib/ # finance-math: pure calculators incl. finance-math/de/
│ │ # (generated BMF PAP Lohnsteuer engines + statutory tables)
│ ├── css/ # base, landing, app styles
│ └── js/ # native ES modules (no bundler); layers point ui → io → domain
│ ├── domain/ # pure logic, no DOM/network: money, dates, schema, ids,
│ │ # loan, asset-value, model, forecast, retirement, merge, store
│ ├── io/ # effects: crypto (encrypt), storage (localStorage/sync/fetch)
│ ├── ui/ # DOM: dom, chart-kit, charts, networth, assets, salary, gate
│ └── main.js # entry point: cross-cutting wiring + boot
├── scripts/ # generators: per-locale pages, BMF PAP → JS, calculator docs
├── tests/ # node --test: domain math, calculators, MCP, i18n page sync
├── schema.sql # D1: one row per account (hash → encrypted blob)
└── wrangler.toml
The Worker runs first (run_worker_first) so it can route the landing page vs
the app by hostname and handle /api/*; everything else falls through to the
static assets binding. The frontend is a plain ES-module graph — the browser
loads it directly, no build step.
Deploy
Requires a Cloudflare account and npm i -g wrangler (then wrangler login).
wrangler d1 create networth-db → copy the database_id into wrangler.toml.wrangler d1 execute networth-db --remote --file=schema.sqlwrangler deploy- Open the URL, create an account, save the number.
Local dev: wrangler dev (serves the app with live API + local D1).
Cut a release with npm version patch|minor|major — a version hook stamps the
new number into the service-worker cache name (public/sw.js) so clients pick up
the new build.
Tests (loan/asset/forecast/retirement math, migrate, multi-device merge, crypto):
npm test (runs node --test tests/*.mjs — the pure domain modules import directly,
no browser needed).
Calculators & MCP
The finance math is also exposed as 99 stateless calculators any client — including AI
agents — can call. They are pure functions of their inputs: no user data, no live prices, no
FX lookups (you pass the rate in), no auth. This is a remote service, so your inputs are sent
to the server — but it stores nothing and logs no request bodies: each call is computed in
memory and discarded.
The German set is the exception that carries data: de-net-salary computes exact Netto for
tax years 2023–2026 via the official BMF Programmablaufplan (generated engines under
public/lib/finance-math/de/, verified against all 1,008 published Prüftabellen values),
with de-abgeltungsteuer, de-kindergeld, de-midijob, and de-rentenpunkte sharing the
same verified statutory table. Everything else stays country-agnostic.
- JSON API:
POST https://nestegg.money/api/calc/<name> (JSON in, JSON out).
GET /api/calc lists them. See public/docs/calculators.md.
- MCP server (Streamable HTTP):
https://nestegg.money/mcp — the same calculators as MCP
tools, with typed outputSchema, read-only annotations, the docs as resources/*, and
canned workflows as prompts/* (mortgage-plan, fire-check, brutto-netto).
Install in an MCP client:
claude mcp add --transport http nestegg https://nestegg.money/mcp
Also published to the official MCP registry as io.github.VladimirWrites/nestegg-calculators
(auto-republished when server.json changes on main), with the descriptor served at
/.well-known/mcp.json and an
llms.txt for agent discovery.
Example (an agent keeps responses small by default, then drills in):
> amortization { amount: 475000, rate: 3.75, mode: "payment", payment: 2869.8, startDate: "2024-04-01" }
→ { monthlyPayment, payments, totalInterest, payoffDate, yearly: [ …per-year… ] } // summary
> amortization { …same…, detail: "monthly", offset: 0, limit: 12 }
→ { schedule: [ …12 rows… ], scheduleTotal: 204, nextOffset: 12 } // paginated
Notes
- New accounts start empty with the current year. Tap the year to add asset
rows, use "+ Year" for more, or "Reset" to start over.
- In a plain preview with no backend it runs local-only via localStorage with
fallback FX rates; sync, live FX and prices activate once deployed.
- The server can't read your figures, but it can see the size of the
encrypted blob, sync times, and your IP — stated plainly in the app footer.
Contributing
Issues and pull requests welcome. The domain logic (public/js/domain/) is pure
and covered by tests — run npm test before sending a PR, and add tests for new
behaviour there. The ui/ and io/ layers are thin and browser-facing; keep DOM
work out of domain/. (package.json version and the service-worker cache name
must match — a test enforces it; run npm run sync-version if it complains.)
License
Licensed under the Apache License 2.0. © 2026 Vladimir Jovanovic.