What end-to-end encryption protects

  • Note titles and rich-text content
  • Images and audio recordings
  • Supported sketch files and previews
  • The user master key, wrapped separately for each approved device

What is not encrypted

The following metadata is not encrypted and can be visible to the sync service: labels, note colors, timestamps, pin, archive, and trash state. It is used for filtering, display, and sync.

Device approval and recovery

Every approved device has a X25519 key pair. A recovery passphrase uses Argon2id to derive the key that protects recovery material. Losing every approved device and the recovery passphrase can make synchronized encrypted notes unrecoverable.