YourNotesYourKey

A secure, end-to-end encrypted note sharing application with zero-knowledge architecture.

Core Security Features

🔐 End-to-End Encryption with Ed25519 Signatures

• AES-128-GCM encryption for note content
• Ed25519 digital signatures for edit authentication
• HKDF key derivation for secure token generation
• Short URLs (~24 characters) using base64url encoding

🔑 Two-Token System

• Read Token: Allows decryption and viewing of notes
• Edit Token: Includes signing key for authenticated updates
• Tokens stored in URL fragments (never sent to server)

🛡️ Zero-Knowledge Architecture

• Encryption happens entirely in your browser
• Server only stores encrypted data and public keys
• We cannot decrypt or read your notes
• No tracking, analytics, or user monitoring

Technical Implementation

Cryptographic Details

• Encryption: AES-128-GCM with WebCrypto API
• Key Size: 128-bit AES keys (16 bytes)
• Signatures: Ed25519 for edit authentication
• Key Derivation: HKDF-SHA256 for deterministic key generation
• Nonce: 96-bit random IV for each encryption
• Token Format: Version header + key material in base64url

Security Properties

• Client-side encryption: All cryptographic operations in browser
• Authentication: Ed25519 signatures verify edit permissions
• Integrity: GCM mode provides authenticated encryption
• Forward secrecy: Each note has unique encryption keys
• No key escrow: Keys never leave the client

Getting Started

Development

# Install dependencies
npm install

# Run development server
npm run dev

# Build for production
npm run build

# Start production server
npm start

Environment Setup

Create a .env file with your database connection:

DATABASE_URL="postgresql://..."

Database Setup

# Run migrations
npx prisma migrate dev

# Generate Prisma client
npx prisma generate

Architecture

Frontend

• Next.js 15 with App Router
• TypeScript for type safety
• TailwindCSS for styling
• Web Crypto API for encryption

Backend

• Next.js Server Actions for API
• PostgreSQL database
• Prisma ORM for data access
• Stores only encrypted data and public keys

Security Features

• Password protection (optional)
• Auto-expiration (1 hour to 1 month)
• Self-destruct after reading
• No server-side decryption capability

How It Works

1. Note Creation: Generate random master secret and derive encryption keys
2. Encryption: AES-128-GCM encryption in browser with AAD binding
3. Signature: Ed25519 signature for edit authentication
4. Storage: Server stores encrypted data and Ed25519 public key
5. Sharing: URL contains note ID + encryption tokens in fragment
6. Decryption: Client-side only using token from URL fragment

Privacy Guarantees

• ✅ End-to-end encryption with AES-128-GCM
• ✅ Digital signatures for edit authentication
• ✅ Keys never sent to server (URL fragments)
• ✅ Zero-knowledge storage (we can't read notes)
• ✅ No tracking or analytics
• ✅ Open source and auditable
• ⚠️ Lost tokens = lost notes (no recovery possible)

License

MIT License - See LICENSE file for details

Security

For security issues, please email security@yournotesyourkey.xyz

Contributing

Contributions welcome! Please read our contributing guidelines before submitting PRs.