Sign in

Zero-knowledge encryption in five minutes

A practical explanation of local-first key handling and why server compromise should not reveal plaintext.

2026-02-15

Local-first by default

Encryption should happen before data leaves your browser.

That means the service can store encrypted blobs while never having the decryption key.

What this changes for users

The tradeoff is clear: stronger privacy means users must protect their own master credential and recovery process.

The benefit is that breaches become materially less damaging when plaintext is never centrally held.