Klarinotte / Docs / Encryption Design

Encryption Design

How Klarinotte protects your synced data — the technical details.

The precise claim: Klarinotte is end-to-end encrypted with zero knowledge of your content. Our servers store only ciphertext they cannot decrypt — never your password, your keys, or your note content. They do see some metadata (spelled out below). We word it this way on purpose: a bare "zero-knowledge" claim would overstate it.

This page is the technical companion to Security & Privacy. It describes how the encryption actually works, so you can judge it for yourself rather than take our word for it.

Design goals

End-to-end encryption — content is encrypted on your device before upload.
Zero knowledge of content — the server is a dumb store of opaque blobs.
Local-first — the app works fully offline; sync is optional.
No lock-in — export to plain Markdown at any time.

Key hierarchy

Your password never encrypts data directly. Instead it unlocks a chain of keys:

password ──Argon2id──▶ Password Key ─┐
                                     ├─▶ (unwraps) Master Key ──▶ Vault Key₁ ──▶ notebook 1 data
recovery key ─Argon2id▶ Recovery Key ┘         (random, stable)  ├─▶ Vault Key₂ ──▶ notebook 2 data
                                                                 └─▶ …

Master Key — a random AES-256 key generated once at signup. It never changes when you change your password, so those operations only re-wrap it and never re-encrypt your notes.
Password Key / Recovery Key — derived from your password / recovery key via Argon2id; each independently wraps (encrypts) the Master Key.
Vault Keys — one random key per notebook, wrapped by the Master Key, so compromising one notebook's key doesn't expose the others.
Keys live in your browser as non-exportable keys, so even a script-injection foothold can't steal the raw key material.

Algorithms

AES-256-GCM — authenticated encryption for all content and key wrapping (random 96-bit IV per operation).
Argon2id (memory-hard, OWASP baseline: 19 MiB, t=2, p=1) — stretches your password into a key. Memory-hardness is chosen specifically to resist GPU/ASIC brute-force, even if our database were ever stolen.
bcrypt (server-side) over a client-side PBKDF2 login hash — verifies logins without the server ever seeing your password. Gated by rate-limiting and account lockout.
ECDH P-256 — wraps a notebook's key per member when you share.
Additional Authenticated Data binds each ciphertext to its notebook and entity, preventing cross-vault reuse.

Raising the bar over time

The Argon2id settings are stored per account alongside the wrapped key, not hardcoded — so we can strengthen them over time without locking anyone out. Older accounts are re-encrypted to the current settings transparently the next time you sign in. If your app is ever too old to read a newer format, it tells you to update rather than showing a confusing error.

If you forget your password

A one-time Recovery Key (shown once at signup) can unlock your data independently of your password. If you lose both your password and your Recovery Key, your synced data is unrecoverable — there is no backdoor. Your local on-device copy is unaffected. This is the honest tradeoff of real end-to-end encryption.

What the server can and cannot see

It can never see:

Note content, titles, and tags
Folder names and your organizational structure
Attachment files, filenames, and OCR-extracted text
Bookmark labels and your search queries
Notebook names and device names
Your password, your encryption keys, or your Recovery Key

It does see (metadata, in order to sync):

Your account email — for login and recovery
Timestamps of when items are created, changed, or deleted
The number, size, and type of encrypted items (a note vs. a folder vs. an attachment) — never their contents
Who you share a notebook with — the relationship, not what's inside
Account settings — one blob per account, encrypted on your device with your Master Key. The server cannot read it and cannot see which settings it contains or when any of them changed; it sees only that the blob exists, its size, and when it was last written.

None of this metadata reveals what your notes say.

Verify it yourself

Open your browser's developer tools, go to the Network tab, and watch a sync happen — only ciphertext leaves your device. Everything above uses standard, well-studied cryptography (AES-GCM, Argon2id, ECDH) — no home-grown or proprietary algorithms.

For the legal privacy policy, see our Privacy Policy.