Every note and credential is encrypted inside your browser before it ever reaches our servers. We store ciphertext. We never see the key.
It never leaves the page — not in a request, not in a cookie, not in local storage.
PBKDF2 with a random per-account salt and 100,000 rounds turns it into a 256-bit key.
AES-256-GCM with a fresh random IV for every item you save.
The server stores an opaque blob it has no way to open.
Type something below and watch what actually gets sent over the wire.
_______
/ \
/ \
| |
| .---. |
| | | |
|___|___|___|
Bug reports, feature ideas, or just questions about how the encryption works — this goes straight to us.