Security model, in plain English.
What sync encrypts, what the server can see, and what we don't defend against.
Stays on this Mac: your text, the DEK and the MK.
It matches the next update by path id.
Where your notes live
Your notes are plain Markdown files in a folder on your disk, and any text editor can open them, today or long after you stop using Jotura. Jotura adds no encryption layer on top of your filesystem, so nothing about your notes depends on a format only we can read. To protect them at rest, turn on your operating system's full-disk encryption: FileVault on macOS, BitLocker on Windows, LUKS on Linux. It covers every file on the machine, your notes included, and it is stronger and better audited than anything a notes app could bolt on.
Everything below this line is about sync. When you enable cloud sync, your notes are encrypted on your device before upload, and only ciphertext ever leaves it.
Threat model
Sync protects your notes if someone steals our database, if someone reads the traffic between your laptop and our server, and from us as well, since the people running the server can't read your notes either.
Sync can't protect you from someone who has your machine and is signed in to your OS account, because they can open your notes exactly as you do. Your OS login and full-disk encryption guard against that, and no notes app can keep files away from someone already inside the account that owns them.
Plant the garlic by late October.
Move the rhubarb to the back bed.
Net the kale before the pigeons do.
ProtectedA stolen copy holds your notes only as ciphertext.
ProtectedYour notes cross the network only as ciphertext.
ProtectedWe see ciphertext and HMAC ids, never your notes.
Outside what sync can protectYour OS login and full-disk encryption guard this.
What the server sees and doesn't see
What the server sees
- Your account email
- Your vault's folder name, so you can pick the right vault on a new device
- The name of each folder or note you share, so the invite email can tell the other person what you shared with them
- Opaque encrypted blobs
- HMAC'd path identifiers (so it can route updates without learning the filename)
- KDF salt and parameters
- A verifier blob proving you can derive the key
What it never sees
- Plaintext content
- Plaintext paths or filenames, apart from the vault and share names above
- Your sync password or any password-derived key
- Your master key or any per-file key
The sync crypto stack
Everything here applies to your notes in transit and on our server, while the copies on your own disk stay plain files.
0 notes re-encrypted. Same MK, re-wrapped under the new KEK.
- KDF
Argon2id, m=64 MiB, t=3, p=4over your sync password. Output is a key-encryption-key (KEK).- Master key (MK)
- 32 random bytes generated when you enable sync and wrapped under the KEK, so the MK is never derived from your password directly. Changing your sync password is cheap as a result: Jotura re-wraps the MK and leaves your encrypted notes as they are.
- Per-file
- Every upload gets its own data encryption key (DEK), wrapped under the MK. Your device encrypts the content with
XChaCha20-Poly1305AEAD at push time. - Filename privacy
- The server-visible identifier for each entry is
HMAC-SHA256(path_key, normalized_path). It comes out the same every time, which lets the server route updates while learning nothing about the name. The plaintext filename is encrypted alongside the wrapped DEK.
Recovery phrase
When you enable sync, Jotura generates a recovery phrase of 12 BIP39 words and shows it to you once. The server never stores it. The phrase encrypts a copy of the master key, which is why it can stand in for your password.
Forgetting your sync password won't lock you out of sync, because the phrase still gets you back in. Lose both and the copies on our server are gone for good, because nobody holds a key to them, us included. Your local files stay untouched either way, as plain Markdown on your disk.
Write these down. They won't be shown again.
- 1.orbit
- 2.maple
- 3.harvest
- 4.copper
- 5.violin
- 6.tunnel
- 7.meadow
- 8.anchor
- 9.pepper
- 10.silent
- 11.glimpse
- 12.orchard
Plant the garlic before the first frost.
- Raised bed by the shed
- Order seed potatoes
- Ask Jo about the compost bin
Sync is paused until you enter your sync password. Your notes on this device stay fully usable meanwhile.
Sync passwordForgot password? Use recovery phraseEnter the 12 words, then a new sync password.
Recovery phrase (12 words, separated by spaces)orbit maple harvest copperviolin tunnel meadow anchorpepper silent glimpse orchardNew sync password (12+ characters)••••••••••••Confirm new sync password••••••••••••Cryptography summary
Sync is built on widely reviewed primitives (Argon2id, XChaCha20-Poly1305, BIP39) from well-maintained libraries, and we wrote none of the cryptography ourselves. If you'd like a third-party security review of Jotura's design, get in touch.
The app is free and works offline, and sync is the only part of it that sends your notes anywhere.