Notes on notes
published 2026-11-03 words 135 min 1
Encryption turns data into something that, without the key, can’t be told apart from random noise. Here’s how a notes app does it, step by step, running live in your browser with WebCrypto.
a passphraseonly you know it
a keyPBKDF2, 600,000 rounds, on your device
a noteas you write it
what the server storesAES-256-GCM: noise without the key
-
only you know it
-
salt16 random bytes, stored in the open
-
the keyPBKDF2(passphrase, salt), 600,000 rounds
-
as you type it
-
byte by byte
-
what the server storesAES-256-GCM, a new nonce every time
try to open it
The box above is all the server has: the salt, the nonce, the noise and the tag. Open it the way different people would.
- you, on another device: the same passphrase and the stored salt
- someone guessing, and getting very close
- the server, or anyone in between, quietly changing what it stores
- you, saving the same note twice
Where I use this
My notes live in Plim, which works this way. It also lets me connect Claude to the notes I choose, and build my own small apps with my notes as the backend.
End-to-end encryption isn’t about secrets: it’s that your data stays yours. A server that can’t read your notes can’t sell them, mine them for ads, train on them, or leak them in a breach.