What we store on the server (and what we never see)
A transparent look at the exact fields we persist and why we never see your plaintext.
We’re happy to be explicit about what hits our database. For each note we store: the note slug (from the URL), the ciphertext (encrypted body), the salt (for PBKDF2), the IV (for AES-GCM), and KDF parameters (iteration count, etc.). That’s it. No password, no key, no plaintext.
Why salt and IV are safe to store
Salt and IV are not secret. They’re meant to be public. The salt ensures two users with the same password get different keys. The IV ensures the same key doesn’t produce the same ciphertext twice. An attacker with salt and IV still can’t decrypt without your password.
What we don’t store
- Your password or any hash of it that we could crack.
- The derived encryption key.
- Plaintext or any reversible form of your note.
- IP or logs that would tie a decrypt action to a specific note (we don’t log note access).
FAQ: What we store on the server
Q1. What exactly do you store for each encrypted note?
We store the note slug, ciphertext, salt, IV, and KDF parameters like the PBKDF2 iteration count. We do not store your password, derived key, or plaintext.
Q2. Is it safe that salt and IV are stored on the server?
Yes. Salt and IV are designed to be public. They ensure unique keys and ciphertexts but are useless to an attacker without your password.
Q3. Do you log when I open or decrypt a note?
We don’t log note access in a way that ties specific decrypt actions to specific notes. The goal is to minimise metadata that could be sensitive on its own.
Q4. Could an attacker with full database access decrypt my notes?
Not without your password. They would have ciphertext, salt, IV, and KDF parameters, but PBKDF2 and AES-256-GCM still require your secret to produce plaintext.
Q5. Do you store anything that would let you reset my password?
No. There is no server-side secret that can regenerate your key. That’s why we can’t recover notes if you forget the password.
Where to go next
For more detail on how storage fits into the overall design:
- Read “Zero-knowledge encryption: what it actually means when we can't see your data”.
- Read “Why we encrypt in the browser (and what happens to your password)”.
- Try Inkrypt at https://www.inkrypt.online and inspect network traffic to see which fields actually hit the server.