How encryption works
The exact steps your browser takes, and what our server ends up holding.
The building blocks
We use the encryption built into every modern browser (WebCrypto: AES-256-GCM and HKDF-SHA-256) and the Argon2id password-hashing function from the open-source hash-wasm library. We don't use any home-made cryptography.
Private links
- Your browser makes a random 256-bit key and encrypts your text with it.
- The ciphertext is uploaded. The key is put in the link after
#. Browsers never send that part to a server. - Opening the link proves you hold the key, so someone who only knows the link's ID can't open or burn it.
Your account
When you sign up, your browser stretches your password with Argon2id (64 MB of memory, 3 passes) and splits the result in two:
- An auth key that is sent to sign you in. We store only a hash of it.
- An encryption key that never leaves your device. It locks a random master key, which encrypts your notes and vault.
Your browser also makes a recovery key that locks a second copy of the master key. You keep it; we never see it.
If you forget your password
| You have | What happens |
|---|---|
| Your recovery key | Reset your password by email, enter the recovery key, and everything opens as before. |
| No recovery key | You get your account back, but old notes can't be decrypted by anyone. You can start fresh. |
What this can't protect against
Like every web app, the code runs from our server each time you visit. If our server were taken over, an attacker could change that code. We reduce the risk with a strict Content Security Policy, no third-party scripts and self-hosted libraries, but we want you to know the limit.