Security
How your notes are encrypted.
Everything you write is encrypted in your browser before it is sent. Our server stores it and syncs it between your devices, but it never has the key, so it can't read it.
- AES-256-GCM
- PBKDF2 · 600,000 iterations
- Keys never leave your device
- Recovery codes on every plan
Three credentials
Each one does a different job.
Your login gets you to your mailbox. Your passphrase opens the lockbox inside it. A PIN is an optional shortcut on a device you trust.
Your login
Your email and password prove who you are, so the server knows which encrypted notes to send you.
Handled by Auth0. Can’t decrypt anything.
Your passphrase
The secret that encrypts and decrypts your notes. You type it in your browser and it stays there.
Never sent to the server.
Your PIN
Optional. It unlocks a copy of your key kept on this device, so you don’t retype your passphrase each time.
Stays on this device. Never sent anywhere.
When you unlock
One key encrypts your notes. Three ways can unwrap it.
Your notes are encrypted with a random data key. That key is stored only in wrapped form, locked by a key made from your passphrase, recovery code or PIN.
Passphrase
PBKDF2 · 600,000 iterations
Wrapped key stored on the server
Recovery code
64 characters · 320 bits
Second wrapped key on the server
PIN (optional)
PBKDF2 · 1,000,000 iterations
Wrapped key kept on this device
Any one unwraps the data key
Random 256-bit key
Made once, in your browser. Held in a background worker, where the page can’t read it out.
Encrypts with AES-256-GCM
Notes, files and memories
Each item gets its own random IV, so two identical notes never look the same encrypted.
Your passphrase is stretched
Your browser runs it through PBKDF2 600,000 times to make a key-encryption key. That makes each guess slow and expensive for an attacker.
The data key is unwrapped
The key-encryption key unlocks your data key. Because they are separate, changing your passphrase only re-wraps one key; your notes aren’t re-encrypted.
The key stays locked away
The data key lives in a background worker as a non-extractable key. Close the tab and it’s gone; lock one tab and every tab locks.
On our server
What we store, and what we can’t read.
Encrypted before it leaves your browser
- Note titles and content
- Collection and tag names
- Saved searches and recent searches
- Memories
- File names and file contents
Stored as is, so we can sync and sort
- Created and updated times
- Sort order and collection hierarchy
- Pin status
- File sizes and types
- IVs, salts and a key check token
- Your data key, wrapped
Never stored
- Your passphrase
- Your recovery code
- Your PIN
- Your unwrapped data key
- Any plaintext from your private notes
Someone with full access to our database would see encrypted blobs and the structure around them. Without your passphrase or recovery code, they can’t turn them back into notes. Neither can we.
On your device
Your browser keeps ciphertext, too.
Offline cache
Notes, collections, tags, tasks and memories are cached in IndexedDB for fast start-up and offline reading. Everything in it is encrypted with your data key.
The session key
Saved as a non-extractable key tied to the open tab. JavaScript on the page, including injected script, can’t read its raw bytes. Closing the tab removes it.
PIN attempts
Wrong PINs are counted across reloads. After 5 there’s a 3-second delay, after 8 a 30-second delay, and after 10 the PIN is cleared and you need your passphrase.
Signing out
Deletes the cache, the saved key and the PIN for every account that used this browser. Your theme and editor preferences stay.
Not encrypted
Recent notes (IDs and times only), which notes you have shared, navigation state and your plan. None of them contain anything you wrote.
Recovery codes
A 64-character code with 320 bits of entropy, made in your browser and shown once. It wraps a second copy of your data key, so you can set a new passphrase if you forget yours. Free and Pro.
Forgot everything?
Without your passphrase or a recovery code, your notes can’t be recovered. If we could get them back without your keys, so could someone else.
Public links
Pro. A shared note is encrypted with a share passphrase you choose (8 characters or more). Visitors decrypt it in their browser, and the server can’t tell a right guess from a wrong one.
AI and MCP
The MCP server runs on your computer and derives your key there. Our server still only sees ciphertext. How it works
Want the details?
Read our privacy policy, or start writing and set up a recovery code first.