Password-Protected Notes: Turning a Password Into a Key

AES-256 needs a 256-bit key: 32 bytes of essentially random data. A password like Autumn2026! is eleven characters of highly non-random data — biased towards dictionary words, capitalised first letters, and a symbol at the end because a form demanded one.

If you fed that password directly into AES as key material, an attacker holding the ciphertext would not need to search the 2^256 keyspace. They would search the far smaller space of passwords people actually pick, which modern cracking rigs work through at enormous rates. A key derivation function exists to make each of those guesses expensive.

Three properties matter here, and each defeats a specific attack.

A salt is random data mixed into the derivation. Because every note gets its own fresh 16-byte salt, the same password produces a completely different key for every note. An attacker cannot build one table of precomputed password-to-key mappings and reuse it — a rainbow table is worthless against salted derivation, and cracking one note gives no head start on the next.

310,000 iterations means the derivation runs the HMAC-SHA256 core 310,000 times before producing a key. On your device that is a brief, one-time pause. For an attacker guessing passwords offline, it multiplies the cost of every single guess by the same factor — turning a hypothetical billion guesses per second into a few thousand.

That figure is not arbitrary: 310,000 is the OWASP Password Storage Cheat Sheet's recommended minimum for PBKDF2-HMAC-SHA256. We record the parameters alongside each note (as a pbkdf2-310000 label), so the count can be raised for new notes without breaking older ones — each note is decrypted with the parameters it was created under.

Because derivation happens client-side, the password itself is never transmitted. There is no password hash in our database, because there is no password in our database. This is what makes the guarantee structural rather than a policy promise — see zero-knowledge encryption.

Key derivation buys you time proportional to how hard your password is to guess. It cannot manufacture entropy that is not there. The practical question is not 'does it look complicated' but 'how many guesses would it take'.

Every 'forgot password' flow you have used works because the service can restore access without your old password — it holds the data in a form it can re-key. That is exactly the capability we have removed.

If we could reset your note password, we could read your note. Those two capabilities are the same capability. The absence of a reset link is not a missing feature; it is the visible edge of the guarantee.