🔒 How end-to-end encryption works

End-to-end encryption makes sure no one but you can read what you send. It's on from the start.

Everything you send is encrypted on your device before it's sent.

Only you know your recovery key. Your encryption key is stored on your devices, and the server keeps it only in a form encrypted with your recovery key or another of your keys. Neither the server that stores your data nor the people who run this service can read it.

The exception: while you allow an AI agent to read your content, our server keeps your encryption key so the agent can use it. During that time, the server can decrypt your data that isn't shared (except locked notes). Shared notes and lists still can't be decrypted by the server, except shared ones for which the owner or an admin has turned on "Allow agents to read contents" (while it's on). See Agents for details.

📱 Sending device Encrypted here

→

☁️ Server Ciphertext only
(can't decrypt)

→

💻 Receiving device Decrypted here

How to use it

Save a passkey or your recovery key the first time — on devices that support unlocking with a passkey, you'll see "Save with a passkey". Save a passkey with your fingerprint or face, and you can start right away. To be safe, you can also save the recovery key shown next. If you don't want to use a passkey, choose "Use a recovery key". The app creates a recovery key on your device and shows it to you. The key is 24 characters long, in 6 groups of 4. Save it with "Copy", "Save to file" or "Save as password" (Chrome and others). To save it as a password in Safari on iPhone, choose "Choose my own" and use the strong password Safari suggests. Once you've saved it, check the box and press "Get started" (when you sign up, you choose your account name first).
On other devices, approve from a device you already use — when you open the app for the first time on another device, or after reinstalling it, you'll need your encryption keys. Press "Approve from another device", then open the app on a device that has your keys. An approval request appears there. Press "Approve on this device", and a 6-digit code appears on the new device. Enter that code on the approving device and press "Approve". Your encryption keys are sent to the new device, and you can start using it right away. The request expires after 10 minutes.
Or enter your recovery key — instead of approving, you can enter the recovery key you saved. If you chose "Later", you can do this in Settings → Encryption.
That's it. Use the app as usual.

What's encrypted

✓ Encrypted

Text and link content
Clipboard content
File content
File names

△ Not encrypted

When and how many items you sent
File sizes
Type (whether it contains text, links, images, videos or files)
Your account name (@name)
Checklist check states, due dates and reminder times
Who you share with, and their roles

For the full list, see the technical details.

⚠️ Important

If you lose your recovery key and no device still has your encryption keys, no one, including the operator, can recover your encrypted data. This is what ensures that no one but you can decrypt it. Keep your recovery key somewhere safe, such as a password manager. Don't show it to anyone.

Shared notes and checklists are end-to-end encrypted too. Only the devices of the people you share with can decrypt them. The server stores only encrypted keys, so the operator can't read the content. For exceptions, see "Exceptions and notes" below.

📱 Your device Encrypted here

→

☁️ Server Ciphertext only
(can't decrypt)

→

👥 Members' devices Decrypted here

A key for each note or checklist — each shared note or checklist gets its own key, and its content is encrypted with that key.
Inviting — when you invite someone by @name, that key is encrypted with their public key before it's sent. Only their devices can decrypt it. Their public key is fetched from the server.
Safety numbers — People you share with in Settings > Sharing shows a safety number (a 30-digit number) for the other person and for you. If it matches the number on their screen, the key is going to the right person. The app remembers the first number it sees, and if the number changes, it stops sharing and lets you know.
Protection key — keys you receive are stored encrypted with your protection key. This is a separate key from your encryption key, and the server keeps it only in a form encrypted with your recovery key or another of your keys.
Invite links — the part of the link after "#" contains the value used to decrypt the key. That part is never sent to the server. Anyone with the link can join, so be careful who you send it to. Links expire after 7 days, and you can revoke them from the sharing screen.
Removing someone — the person you removed can no longer get the content from the server. For checklists and notes, the key is recreated and the content is re-encrypted. If a member leaves or deletes their account, or the key can't be recreated right away, it's recreated the next time the owner, an admin or an editor opens the list or note. Because the removed person still has the old key, if they obtained the server's data, they could decrypt content from before the key was recreated, and note attachments that were there before they were removed. Content they viewed before being removed may remain on their device.

On a device without your protection key, you'll be asked to get it before shared notes and checklists can be shown. Approve from another device or enter your recovery key.

△ Exceptions and notes

When an agent adds items to a shared checklist, the content goes from the agent to the server. The server encrypts it right away and doesn't store the unencrypted content.
When the owner or an admin turns on "Show name to agents" for a shared checklist, its name is stored on the server unencrypted, and every member's agents can find it by name. Every member is notified when it's turned on or off, and a badge appears at the top while it's on. Turning it off deletes the name from the server.
When the owner or an admin turns on "Allow agents to read contents" for a shared note or checklist, its key is stored on the server, and agents of members who allow access to contents can read and edit it. While it's on, the operator could decrypt it too. It turns off automatically when agents don't use it for 14 days, or 90 days after it was turned on. Then the key is deleted from the server and a member's device renews it. Every member is notified when it's turned on or off, and a badge appears at the top while it's on. See Sharing for details.
The app remembers the first safety number it sees for each person. If the server swapped in a different public key from the very start, you'd only notice by comparing numbers.
Members and pending invitees, their roles, and who did what and when in the history aren't encrypted. The content of items is encrypted.

For the details of how keys are exchanged, see the technical details. For how to share and what each role can do, see Sharing notes and checklists.

Locked notes

Keep things you especially want to protect, such as passwords or account numbers, in locked notes. You need your PIN each time you open one. For how to use them, see Locked notes.

The key for locked notes is encrypted with a key made from your PIN and your protection key. The server can't decrypt your protection key, so the operator can't open them by guessing PINs. The server checks whether your PIN is correct and counts wrong attempts, so even someone who steals your device gets only 10 tries. In case you forget your PIN, a copy encrypted with a key derived from your recovery key is also stored. If you turn on passkey unlock, a copy encrypted with a key made from your passkey is stored too. The value used to make that key never leaves your device, so the server can't decrypt it.

△ Exceptions and notes

Locked notes aren't shown to agents or connected apps, and they can't be shared.
When you add a lock to an existing note, its earlier content stays in backups, still encrypted, for up to about 90 days. For things you want to protect, we recommend writing them in a new locked note.
The content of locked notes isn't saved in your device's search data, so it doesn't appear in search while they're locked.
You can't save while offline, because the content isn't kept on your device.
Reminder notifications show only "Locked note".

FAQ

Is my recovery key sent to the server?

No. Keys are derived from your recovery key on your device, and all encryption and decryption also happen on your device. The server only receives encrypted data.

The server stores a value used to derive the key (the salt), data used to check that a key is correct, and your keys encrypted with a key derived from your recovery key.

Can the operator really not read my data?

No. Even looking directly at the server's database, all you'd see is meaningless random characters. However, as shown in the table above, information such as when you sent items, how many, and their size can't be hidden.

The exception is while you allow an AI agent to read your content. During that time, your encryption key is stored on our servers so the agent can read and write your data. Because we hold your key, the operator can decrypt your data that isn't shared (except locked notes).

Access to contents turns off automatically when an agent doesn't use it for 14 days, or 90 days after you allow it. When no agent has access to contents, the stored key is deleted right away, and the next device that opens the app renews your encryption key. Data you save after that is encrypted with the new key, so the operator can't decrypt it.

The weekly database backup (kept for 90 days) and the database's restore history (up to 30 days) still contain an encrypted copy of the key from before it was deleted. With these and a secret value on the server, the operator could decrypt only the data you saved before a device renewed the key.

Shared notes and checklists stay unreadable even then (except those with "Allow agents to read contents" turned on), because their keys are encrypted with your protection key, not your encryption key. This keeps one member's settings from exposing what everyone shares. The protection key is stored on the server encrypted with another key derived from your recovery key. So when you enter your recovery key, your protection key is restored too.

Does approving a device send my key to the server?

No. The new device and the approving device each create a temporary key pair. The approving device encrypts your encryption key with a key derived from both key pairs before sending it. The server only relays the data and can't decrypt it.

The 6-digit code appears only on the new device, and you can't approve without entering it on the approving device. The code also checks that the server hasn't swapped in a different device along the way. If the code you enter is wrong, the request is canceled and you'll need to start again on the new device.

Someone who knows your sign-in details can't get their device approved unless you can see the code on its screen. Never enter a code someone else gives you. The approval request also shows the requesting device's type, approximate location, and time. The device name is chosen by the requesting device itself. If you don't recognize the type or location, press "Deny". Approvals are also recorded in your notifications.

Can I choose my own recovery key?

Yes. On the first screen, select "Choose my own". It must meet these three requirements:

At least 12 characters
Not too simple, such as repeated characters
Doesn't contain your account name (@name)

Several words separated by spaces make a key that's easy to remember and hard to guess.

Can I use the app without encryption?

No. Encryption can't be turned off, and everything you save is encrypted. However, files sent from Shortcuts aren't encrypted. See below for details.

How do I check that my saved recovery key is correct?

In Settings → Encryption, press "Check" next to "Recovery key" and enter the key you saved. The app tells you whether it's correct. Checking doesn't change your keys. If you lost your recovery key or someone may have seen it, press "Change" in the same place on a device that has your keys to create a new recovery key. The old recovery key stops working, but your other devices keep working.

How do I renew my encryption key?

In Settings → Encryption, tap "Renew" next to "Encryption key". Use this if you lose a device, for example. After you renew it, data you save from now on is encrypted with a new key. Data you saved earlier stays readable on all your devices. Access to contents is turned off for all agents.

Your other devices get the new key the next time they open the app. The new key is encrypted with your protection key and kept on the server, so on a device without the protection key, enter your recovery key or approve it from a device you use.

Can I sign in and unlock with a passkey?

Add a passkey under "Passkeys" in Settings → Encryption, and on a new device you can sign in and unlock in one step with your fingerprint or face, using "Sign in with a passkey" on the first screen (no recovery key needed). It works on devices your passkeys sync to. After signing in, you can also unlock with "Unlock with a passkey". You won't see these options in browsers or password managers that don't support unlocking with a passkey.

To create an account, sign in with Google, GitHub or X. If you lose your passkey, you can still sign in with them.

The server stores the passkey's public key, and your encryption key and protection key encrypted with a key derived from the passkey. The value used to derive that key never leaves your device, so the server can't decrypt them. When you sign in, the server verifies the passkey's signature.

What happens on a device that doesn't have my keys?

It can't read encrypted data. To prevent anything from being sent unencrypted, it also can't send anything new or write notes. Once you approve it from a device you use or enter your recovery key, you can use it as usual.

How do I use a shared computer?

On the decrypt screen, turn on "Don't save keys on this device (shared computer)". You can also change it in Settings → Encryption under "This device". When it's on, the encryption key, search data, notes waiting to be sent and drafts aren't saved on the device, and they're deleted when you close the tab. Closing the browser signs you out. Each time you open the app, unlock with approval, a passkey or your recovery key.

Notifications on this device don't show contents. Notes you write while offline are lost if you close the tab before they're sent.

If your browser is set to reopen the pages you had open, or if you added the app to the Home Screen on iPhone or iPad, you may stay signed in after closing it. Even then, you're signed out 12 hours after you last used the app. When you're done, sign out.

Why do notifications show the content?

Your device decrypts the incoming ciphertext before showing the notification. Devices that don't have your keys show only "🔒 New item", without the content.

Are items sent from Shortcuts encrypted?

Text and URLs are stored encrypted. Because Shortcuts can't perform the encryption, the content reaches the server unencrypted, but the server encrypts it as soon as it arrives and doesn't store the unencrypted content.

Files aren't encrypted.

Technical details

A key is derived from your recovery key with PBKDF2 (SHA-256). It uses 300,000 iterations, or 1,000,000 for a recovery key you choose. This key is used to restore your encryption key and protection key. Data is encrypted with AES-GCM (256-bit). Keys are stored in your device's browser. On a device with "Don't save keys on this device" turned on, they're kept only in the open tab. These are standard cryptographic techniques also used by banks and government agencies.

For device approval, the new device and the approving device each create a temporary key pair (ECDH P-256). Both devices derive the same key from the two key pairs with HKDF, and that key is used to encrypt your encryption key with AES-GCM before it's sent. The 6-digit code is derived from both devices' public keys and random values. The approving device checks the entered code on the device itself. The code is never sent to the server.

Sharing uses a key pair for each user (RSA-OAEP, 3072-bit). The key of a note or checklist is encrypted with the recipient's public key before it's sent.

A recovery key created by the app is 24 characters long (120 bits), using 32 characters that exclude the easily confused I, L, O and U. When you enter it, hyphens, spaces and letter case are ignored.

For the key hierarchy, what the server stores and more, see the technical details.