Security
The server can't read your notes
Everything you write is encrypted on your devices with keys the server never gets. This page explains how, what the server can still see, and where the current limits are.
The detail, for reviewers too, is in the docs: the security model, and getting your notes out with nothing but an export and your recovery key.
What the server sees
| Data | Protected by | Server can see |
|---|---|---|
| Note text, titles, file and folder names, tags, links | Encryption on your device: each note with its own key, names and folders with the vault's key | No |
| Attachments | Encryption with the vault's key, on your device | Size only |
| Vault names, icons and pictures | Same | No |
| Version history | Encrypted snapshots | Count, size, time, author |
| Who is looking at which note, cursors | Encrypted presence messages | That someone is connected to a vault |
| Favorites, recent notes, trusted keys | Encryption with your account key | No |
| Accounts, memberships, roles, devices | Access checks on the server | Yes, needed to run |
The server also learns how many notes a vault has, the size and timing of changes, and who changed something when. That is the minimum it needs to sync, and it is listed here so you can judge it.
"The server" here means whoever can read its database or its backups. An instance's administrators see accounts and storage totals in the app, not who works with whom or when. The logs record no accounts, names or IP addresses, and IP addresses are never stored.
The keys
- Account keyYour identity. Every other key is wrapped to it. Its fingerprint is what people compare.on your devices only
- Device keysEach browser and computer gets its own. A new device is approved by one you already use.one per device
- Recovery key256 random bits, shown once when you set up. Unlocks your account if every device is lost.written down by you
- Vault keysEncrypt the vault's name, its index of note and folder names, and its attachments, and wrap each note's key. Wrapped to each member's account key; replaced when someone is removed.one per vault, with versions
- Note keysEvery note has its own key, wrapped under the vault key for members. Sharing a note on its own starts a fresh one, so the person sees that note from then on and nothing else.one per note, with versions
Notes are encrypted with XChaCha20-Poly1305. Keys are wrapped for people and devices with HPKE (RFC 9180, X25519), and account keys sign with Ed25519. Every ciphertext is bound to its vault, note and purpose, so it can't be moved somewhere else and still decrypt.
Checking who is who
When you share with someone, the app shows their key's fingerprint. Compare it with them once, in person or on a call. After that the app remembers it and warns you loudly if it ever changes.
C64B 497F 54AC 92D2 968A 9AD6 CACD 7C13Adding a device
A new browser or computer shows a short code. A device you already use shows the same code; approve only if they match. The code covers both the new device's key and your account key, so a tampering server can neither slip in its own device nor hand the new one fake keys. Lost every device? Your recovery key unlocks the account and enrolls a new one.
Signed membership
The vault's owner signs every change to who belongs to it, and to its keys, into a chained log that every app checks. A server can't add someone on its own, hand out a vault key the owner didn't make, or quietly roll the log back.
Signed edits
Every change and every history snapshot is signed by the person who made it. Apps accept content only from people the vault's log lets write, so neither the server nor a viewer can slip in edits under someone's name.
Removing someone
Removing a member gives the vault a new key, so they can't read anything written afterwards, even with a copy of the encrypted data. What they already saw or downloaded can't be taken back.
Open source
All of notekpr is open source under the AGPL: the server, the web app and the command-line client share one Rust core for all cryptography. Read it, run it, check it.
Current limits
- No independent audit yet. The cryptography uses standard, audited building blocks, but the design and code have not been reviewed by an outside firm.
- The first key you see is trusted. A malicious server could hand out a wrong key the first time you share with someone. The owner-signed membership log stops a server from adding people or planting keys, but the first key you see for someone is trusted until you compare fingerprints.
- Metadata is visible. The server knows who shares with whom, sizes and timing, as listed above.
- Plain text on disk is your choice. The Markdown folder is ordinary files; protect your computer with full-disk encryption.
- Browsers are browsers. In the web app your device key and an encrypted copy of your vaults live in the browser profile, as safe as that profile. "Forget this browser" removes both. If you turn on offline use for a browser, it also keeps the keys to open that copy, so a copy of the profile can be read without the server; it is off unless you choose it.
The full threat model, with what each attacker can and can't do, is in the docs: the security model.