Encrypted notes that stay on your device

Your passphrase is hashed with PBKDF2-SHA256 at 250,000 iterations against a random 16-byte salt. That produces a 256-bit AES-GCM key. The whole vault (all notes) is serialised as JSON, encrypted with a fresh random 12-byte IV, and stored in IndexedDB as a single blob. On save, the process repeats with a new IV. Nothing plaintext ever touches disk.

In the browser IndexedDB on your device, under the origin tooldeck.online. This is local storage inside the browser, not on a server. It survives closing the tab, closing the browser and restarting the computer. It is wiped if you clear site data for this site or uninstall the browser profile. Export a backup before you clear browsing data.

No. There is no backend. The passphrase, the derived key, the plaintext vault and the encrypted blob all stay inside the browser tab. After the page loads, the tool makes zero network requests. You can verify this by opening the browser network tab and watching it during use.

The notes are unrecoverable. This is not a limitation we chose, it is the point of client-side encryption. There is no reset, no recovery email, no backdoor. That is the trade-off for having notes that only you can read. Save your passphrase somewhere safe, or export the vault and store the passphrase in a password manager.

At least 12 characters, ideally a four or five word passphrase with a number and a symbol. The strength meter in the tool gives a rough estimate. The whole security of the vault rests on the passphrase, so treat it like a master password. A password manager is the right place to store it.

PBKDF2-SHA256 with 250,000 iterations is a well-established key derivation function and is what the Web Crypto API provides natively. Argon2id is stronger against GPU attacks but is not available in the browser without a JavaScript implementation, which would be slower and riskier. For a local-only vault, PBKDF2 at this iteration count is a reasonable and safe choice.

Yes, but not by syncing automatically. Export the vault as a .tdnotes file on device A, transfer it however you like (USB, email, cloud storage), and import it on device B. Unlock with the same passphrase. Manual export and import keeps the tool a true local-first app with no cloud dependency.

Open Settings and click Export vault. You get a .tdnotes file containing the encrypted vault. Save it anywhere: a USB stick, an external drive, an email to yourself or a cloud folder. The file is still encrypted, so even if a cloud provider reads it, they see only ciphertext.

A JSON document with the format version, the KDF parameters (algorithm, iterations, salt), the cipher parameters (algorithm, IV) and the encrypted payload as base64. It also stores an optional hint you can set when you create the vault, which is kept unencrypted so you can see it on the unlock screen.

The hint is an unencrypted reminder that appears on the unlock screen. Useful for a phrase that only you would understand: the name of your first pet, a specific date, the last four digits of a number you remember. Do not put the passphrase itself in the hint. Anyone who reads the vault file can read the hint.

Yes. When the vault locks, the CryptoKey object and the plaintext vault are dropped from React state. The browser garbage collects them shortly after. Reopening requires the passphrase again, which re-derives the key from scratch. There is nothing left in memory to steal while locked.

Only one at a time in this tool. If you need separate vaults for separate purposes, use two browser profiles, or export the first vault, delete it locally, create the second. The export and delete buttons are both in Settings.

Thousands. Because the whole vault is loaded into memory on unlock and re-encrypted on save, the practical limit is your device memory. A vault with 10,000 short notes is still under 5 megabytes, well within comfortable bounds. Very large notes (many megabytes of text) will slow saves slightly.

Yes. After the page loads once, the vault works entirely offline. The page itself is a normal static Next.js page, so the browser caches it. Loading the page from cache, unlocking, editing notes and exporting all work with no internet connection.

The tool works in mobile browsers. Because everything is stored locally in the browser, it behaves the same on a phone as on a laptop. The only difference is that iOS sometimes clears IndexedDB for sites you have not visited in a while, so regular exports are a good habit on mobile.

Yes, while the vault is unlocked. Because the vault is decrypted into memory during use, search runs against the plaintext, which stays local. When the vault is locked, there is nothing to search, because nothing is decrypted.

Not yet. This version stores text only. If you need to keep a file with a note, encode it as base64 and paste it in. Attachments as first-class objects are a possible upgrade but would grow the vault size quickly.