Engineering & security research
Inkrypt Security Team
The engineers who build and maintain Inkrypt's encryption layer
The Inkrypt Security Team is the small group of engineers who write, review and maintain the cryptographic code that runs in your browser every time you create a note. Everything published under this byline is written by someone who has worked directly on the code being described.
That constraint is deliberate. A large amount of encryption writing on the web is produced by people who have read specifications but never shipped a key-derivation routine, and it shows: the advice is technically defensible but practically useless, because it omits the trade-offs you only discover when real users hit them. When we write that PBKDF2 at 310,000 iterations takes a noticeable moment on an older phone, it is because we measured it on one.
We write about what we have implemented, benchmarked, or deliberately chosen not to build. Where we are describing something outside that direct experience — a competing product's architecture, a standard we have read but not implemented — we say so in the text and cite the primary source.
About this byline
Inkrypt Security Team is an organisational byline, not an individual. It covers the engineers who build and maintain Inkrypt itself, and it is used because accountability for this material sits with the team that maintains the shipping code rather than with any one person. The team is reachable directly at the address below, and every claim published under this byline can be checked against the running product.
Areas of expertise
- Client-side encryption in the browser
- Web Crypto API and SubtleCrypto
- AES-GCM authenticated encryption
- Password-based key derivation (PBKDF2, Argon2)
- Zero-knowledge system design
- Threat modelling for consumer privacy tools
Responsibilities on this site
- Writes and technically reviews every article touching cryptography
- Maintains the security architecture and threat model pages against the shipping code
- Triages inbound vulnerability reports
Contacting this team
Corrections, sourcing questions and feedback on anything published under this byline go to the address below, or through the contact form. How corrections are handled once received is set out in the editorial policy.
Published articles
How to Judge an Encrypted Note Service
How to evaluate an encrypted note tool: the recovery question, a one-minute browser test, where the key travels, and what deletion actually means.
11 min read
AES vs RSA Encryption: Why We Encrypt Notes With AES-256-GCM
AES vs RSA encryption explained, then the decision itself: why Inkrypt encrypts note content with AES-256-GCM, and why RSA was the wrong tool for it.
12 min read
Client-Side vs Server-Side Encryption: What Is the Difference?
Learn the difference between client-side encryption and server-side encryption, how they protect your data, and which option is best for your privacy needs.
15 min read
What Is Zero-Knowledge Encryption? How It Protects Your Data
Zero-knowledge encryption explained: what it means, how it works, how it differs from standard cloud encryption, and how to verify a service really uses it.
14 min read