feat: encrypt profile entries with passphrase-derived key, migrate to typescript by MoustaphaCamara · Pull Request #7 · elabftw/desktop

MoustaphaCamara · 2026-05-07T14:37:54Z

small tweaks

moved css to dedicated folder
separated in files to optimize usage
style.css -> src/css/main.css
subfiles in src/css/buttons.css, css/inputs.css etc.
helpers in utils/helpers.ts
migrate to typescript

fix #2
fix #8 86745a6
fix #11 5bfa1b2
fix #12 5a10e8d
fix #14

encryption

Encrypt local profile entries with passphrase-derived keys

Replace stored profile passphrase hashes with passphrase-derived local encryption
generate an Ed25519 keypair when creating a profile
store the public key, key salt, and encrypted private key in profile index
derive anunlock key from the passphrase and use it to decrypt the private key
Encrypt entry title/body before saving to SQLite
Decrypt entry title/body after reading from SQLite
Clear in-memory profile keys on logout!

note: currently, the SQLite database file is still readable as a SQLite file, but entry content is encrypted. Table names, row counts, and timestamps are not encrypted in this PR. I'm not sure if we wanted to encrypt only the content or also the db itself, but files cant be read even via db. e.g.,

PROFILE=enter a profile uuid from index.json
DB="$HOME/.config/elabftw-desktop/profiles/$PROFILE/data.sqlite3"
sqlite3 "$DB"
.tables
# output: entries
.schema entries
# output: the schema of the entries table

Now try to read some

select id, title, body FROM entries;
# expected output: 1 | blablablahashed-title-long-random-looking-base64|blablablahashed-body-same-rdm-looking
.quit

Steps to reproduce & test

Create a new profile with a passphrase
Verify wrong passphrase does not unlock the profile
Create entries and confirm title/body are not readable in data.sqlite3
Verify entries decrypt correctly after unlocking with the right passphrase :)

Summary by CodeRabbit

New Features
- Profiles now use per-profile cryptographic keys with in-memory unlock/lock and encrypted profile secrets.
- Entry titles and bodies are encrypted at rest.
- New profile selector UI with create, unlock, and delete flows.
Bug Fixes
- Improved form submission, entry save/load flow, and error handling.
Style
- Added global styles for alerts, buttons, inputs, profiles, and core theme tokens.
Chores
- Tooling and dependency updates.

active profile set to null app-state back to select-profile

…mits the raw value

did not know the ci in private repos is limited in minutes, monthly so this one should be trigerred only on workflow dispatch, not on every push. Keeping the lint for every push/pr but not this one

Encrypt local profile entries with passphrase-derived keys - Replace stored profile passphrase hashes with passphrase-derived local encryption - generate an Ed25519 keypair when creating a profile - store the public key, key salt, and encrypted private key in profile index - derive anunlock key from the passphrase and use it to decrypt the private key - Encrypt entry title/body before saving to SQLite - Decrypt entry title/body after reading from SQLite - Clear in-memory profile keys on logout! note: currently, the SQLite database file is still readable as a SQLite file, but entry content is encrypted. Table names, row counts, and timestamps are not encrypted in this PR. I'm not sure if we wanted to encrypt only the content or also the db itself, but files cant be read even via db. Steps to reproduce & test - Create a new profile with a passphrase - Verify wrong passphrase does not unlock the profile - Create entries and confirm title/body are not readable in `data.sqlite3` - Verify entries decrypt correctly after unlocking with the right passphrase :)

- Replace stored profile passphrase hashes with passphrase-derived local encryption - Generate a random per-profile salt when creating a profile - Derive a local encryption key from the passphrase using Argon2id - Store the salt and an encrypted verifier in the profile index - Verify the passphrase by deriving the same key and decrypting the verifier - Encrypt entry title/body before saving to SQLite - Decrypt entry title/body after reading from SQLite - Clear the in-memory profile key on logout

now it goes - generate ed25519 keypair when creating a profile - store the public key, salt, and encrypted private key in the profile index (it is needed ! to have something persistent that proves the passphrase is correct after the app restarts, while recovering the same Ed25519 identity) - derive an unlock key from the passphrase using Argon2id - Use the derived key to decrypt the encrypted private key when unlocking a profile - Treat private key decryption failure as an invalid passphrase - Encrypt entry title/body before saving to SQLite - Decrypt entry title/body after reading from SQLite - Clear in-memory profile keys on logout

see https://caniuse.com/?search=autocomplete+new-password

NicolasCARPi

on create new entry, reset state (title), instead of asking other components to remember to do it

remove all ed25519 code: we don't sign anything.

crypto is:

passphrase + salt (stored in clear in json profile) = master key

use the master key to decrypt data, because it's authenticated, you'll get an error if it's not the correct key.

NicolasCARPi · 2026-05-18T12:43:45Z

@@ -0,0 +1,321 @@
+.app-shell {


try and refactor this, remove many things

NicolasCARPi · 2026-05-18T12:53:29Z

@@ -0,0 +1,30 @@
+import type { Action } from 'svelte/action';


try and use Attachments

MoustaphaCamara added 30 commits May 6, 2026 14:31

Add logout button

79f741e

active profile set to null app-state back to select-profile

a11y - replace a with button

3d23537

update logout

6b34331

add Delete Profile method

0119df8

refresh on save & back

da502cd

login with passphrase functionning

2b15db5

gofmt :)

e40ce94

chore: add dev helpers

6b8dbf6

some quick styling

0e41e09

not used

95c7ded

🐰 suggestion on step 2

22fef54

toggle menus between them

e9d921a

require passphrase for deleting

5a6f7a8

why did it not push

f84dbdc

remove unused code

cc54c5e

🐰 avoid committing the index before profile directory is actually gone

6e19c7e

🐰 avoid committing the index before profile directory is actually gone

c7e5bb0

🐰 order

ccd7c3f

errors and order

7610a1d

ul have default margin

ac49065

homogenize

c17df38

homogenize

6cce645

some cleaning

29e76d4

confirmAddProfile() normalizes the passphrase, but unlock() later sub…

348b097

…mits the raw value

update build.yml to manual-only for now

470a0d3

did not know the ci in private repos is limited in minutes, monthly so this one should be trigerred only on workflow dispatch, not on every push. Keeping the lint for every push/pr but not this one

same for lint

1e11cea

chore: framework: update svelte from 3.49 to 5.5

f396261

run npx sv migrate

edd4e40

leftovers manual replacement

2735386

MoustaphaCamara added 11 commits May 13, 2026 10:16

fix delete

105bf7d

handle typescript

a14288e

typescriiiiipt

1fa004f

use types from go

73c06ac

use typescript, helper functions

8bb2ba4

use preventDefaultSubmit helper

1496750

rename keysalt to salt

fb14b8a

rename keysalt to salt

ea1613e

rename keysalt to salt

9a806d8

🐰

2c023b5

MoustaphaCamara changed the title ~~step5feat: encrypt profile entries with passphrase-derived key~~ step5feat: encrypt profile entries with passphrase-derived key, migrate to typescript May 13, 2026

MoustaphaCamara marked this pull request as ready for review May 13, 2026 10:27

MoustaphaCamara mentioned this pull request May 13, 2026

migrate to ts #14

Open

MoustaphaCamara added 2 commits May 13, 2026 14:42

remove apostophers

4033664

MoustaphaCamara changed the title ~~step5feat: encrypt profile entries with passphrase-derived key, migrate to typescript~~ feat: encrypt profile entries with passphrase-derived key, migrate to typescript May 18, 2026

MoustaphaCamara added 6 commits May 18, 2026 11:15

force delete because we have many legacy profiles during these updates

cb700fe

workflow

194859b

profile selector review

a5302d6

autocomplete new-password only available for firefox

53bd02f

see https://caniuse.com/?search=autocomplete+new-password

global styling

a42b594

danger button

c0afaca

NicolasCARPi requested changes May 18, 2026

View reviewed changes

MoustaphaCamara added 6 commits May 18, 2026 16:43

remove forceDelete

a6d7b23

finish removing ForceDelete

b62bb7c

remove unneeded one liners

ebe5578

add profileName instead of uuid to logged-in profile

4df13b8

styling fixes

aa5fa71

todo for stylelint

8e6d176

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: encrypt profile entries with passphrase-derived key, migrate to typescript#7

feat: encrypt profile entries with passphrase-derived key, migrate to typescript#7
MoustaphaCamara wants to merge 77 commits into
masterfrom
mouss/260507-step6-encryption

MoustaphaCamara commented May 7, 2026 •

edited

Loading

Uh oh!

NicolasCARPi left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NicolasCARPi May 18, 2026

Uh oh!

Uh oh!

NicolasCARPi May 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

		@@ -0,0 +1,30 @@
		import type { Action } from 'svelte/action';

Conversation

MoustaphaCamara commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

small tweaks

encryption

Summary by CodeRabbit

Uh oh!

NicolasCARPi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NicolasCARPi May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

NicolasCARPi May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

MoustaphaCamara commented May 7, 2026 •

edited

Loading