Zero-Knowledge Notes
"Zero-knowledge" gets thrown around loosely in marketing. Here's what it actually means in xNotePadAI: your encryption key is derived from your password on your device. We never receive your password or your key. We mathematically cannot read your notes — even if we wanted to.
Client-Side Key Derivation
Your password never leaves your browser. PBKDF2 with 600,000 iterations generates the encryption key entirely on your device.
Server Sees Only Ciphertext
When you sync, the server stores encrypted blobs. Even with full database access, an attacker gets nothing but random-looking bytes.
No Password Recovery
We cannot reset your password or recover your data. This is the proof of zero-knowledge — if we could recover it, we could also read it.
Verifiable Architecture
Inspect network traffic yourself. Every sync payload is encrypted before transmission. No plaintext ever appears in any network request.
SHA-256 Integrity
Every synced note includes a SHA-256 checksum. If anything is modified in transit or on the server, your client detects the tampering instantly.
No Metadata Leakage
Note titles, tags, and timestamps are all encrypted. The server knows nothing about the structure or content of your knowledge base.
What about Apple Notes "encryption"?
Apple Notes offers per-note locking, but iCloud sync is not end-to-end encrypted by default. You must opt into Advanced Data Protection, which most users never do. Even then, Apple controls the key infrastructure. xNotePadAI's encryption is always on, always client-side, and the key derivation is entirely under your control.
Truly private. Mathematically provable. Free forever.
Frequently Asked Questions
How is zero-knowledge different from end-to-end encryption?
End-to-end encryption means data is encrypted between two parties. Zero-knowledge goes further — the service provider has no knowledge of the content at any point. We cannot decrypt, cannot access, and cannot be compelled to hand over readable data.
What if a government demands my data?
We can only hand over encrypted blobs. Without your password (which we never have), the data is meaningless. Zero-knowledge architecture makes compliance with data requests technically irrelevant — there is nothing useful to hand over.
Can AI features work with zero-knowledge?
Yes. AI processing happens on-demand when you request it. Content is decrypted locally, sent for AI processing, and the AI response is returned — all within a single transient request with no storage. At rest, everything remains encrypted.