Encryption Design

How Klarinotte protects your synced data — the technical details.

The precise claim: Klarinotte is end-to-end encrypted with zero knowledge of your content. Our servers store only ciphertext they cannot decrypt — never your password, your keys, or your note content. They do see some metadata (spelled out below). We word it this way on purpose: a bare "zero-knowledge" claim would overstate it.

This page is the technical companion to Security & Privacy. It describes how the encryption actually works, so you can judge it for yourself rather than take our word for it.

Design goals

End-to-end encryption — content is encrypted on your device before upload.
Zero knowledge of content — the server is a dumb store of opaque blobs.
Local-first — the app works fully offline; sync is optional.
No lock-in — export to plain Markdown at any time.

Key hierarchy

Your password never encrypts data directly. Instead it unlocks a chain of keys:

password ──Argon2id──▶ Password Key ─┐
                                     ├─▶ (unwraps) Master Key ──▶ Vault Key₁ ──▶ notebook 1 data
recovery key ─Argon2id▶ Recovery Key ┘         (random, stable)  ├─▶ Vault Key₂ ──▶ notebook 2 data
                                                                 └─▶ …

Master Key — a random AES-256 key generated once at signup. It never changes when you change your password, so those operations only re-wrap it and never re-encrypt your notes.
Password Key / Recovery Key — derived from your password / recovery key via Argon2id; each independently wraps (encrypts) the Master Key.
Vault Keys — one random key per notebook, wrapped by the Master Key, so compromising one notebook's key doesn't expose the others.
Keys live in your browser as non-exportable keys, so even a script-injection foothold can't steal the raw key material.

Algorithms

AES-256-GCM — authenticated encryption for all content and key wrapping (random 96-bit IV per operation).
Argon2id (memory-hard, OWASP baseline: 19 MiB, t=2, p=1) — stretches your password into a key. Memory-hardness is chosen specifically to resist GPU/ASIC brute-force, even if our database were ever stolen.
bcrypt (server-side) over a client-side PBKDF2 login hash — verifies logins without the server ever seeing your password. Gated by rate-limiting and account lockout.
ECDH P-256 — wraps a notebook's key per member when you share.
Additional Authenticated Data binds each ciphertext to its notebook and entity, preventing cross-vault reuse.

Raising the bar over time

The Argon2id settings are stored per account alongside the wrapped key, not hardcoded — so we can strengthen them over time without locking anyone out. Older accounts are re-encrypted to the current settings transparently the next time you sign in. If your app is ever too old to read a newer format, it tells you to update rather than showing a confusing error.

If you forget your password

A one-time Recovery Key (shown once at signup) can unlock your data independently of your password. If you lose both your password and your Recovery Key, your synced data is unrecoverable — there is no backdoor. Your local on-device copy is unaffected. This is the honest tradeoff of real end-to-end encryption.

What the server can and cannot see

It can never see:

Note content, titles, and tags
Folder names and your organizational structure
Attachment files, filenames, and OCR-extracted text
Bookmark labels and your search queries
Notebook names and device names
Your password, your encryption keys, or your Recovery Key

It does see (metadata, in order to sync):

Your account email — for login and recovery
Timestamps of when items are created, changed, or deleted
The number, size, and type of encrypted items (a note vs. a folder vs. an attachment) — never their contents
Who you share a notebook with — the relationship, not what's inside

None of this metadata reveals what your notes say.

Verify it yourself

Open your browser's developer tools, go to the Network tab, and watch a sync happen — only ciphertext leaves your device. Everything above uses standard, well-studied cryptography (AES-GCM, Argon2id, ECDH) — no home-grown or proprietary algorithms.

For the legal privacy policy, see our Privacy Policy.