Security and privacy

Kithnote has two separate protections. Sync encryption protects your notes in the cloud. The optional vault password protects the notebook on one device. They use different secrets.

No independent audit

Kithnote hasn't had an independent security audit.

Sync encryption

Each note is encrypted on your device before it is uploaded, using AES-256-GCM. The title, text, folder, favorite flag, dates and Trash state are all inside the encrypted note.
The key is a random 32-byte key made on your device when you create the vault. It is not derived from a password.
The service never receives the key.
The key is stored in your connection kit. Anyone with the kit can read and change the vault. See Sync.
Losing the kit and every connected device means the cloud copy can't be decrypted. Account recovery can't restore lost encryption keys.
An .enotes encrypted backup also contains the connection kit, which is another reason to use a strong password.
This relies on the app code you run. The browser app is delivered by the service, so a compromised service could deliver code that reads your notes. Encryption also doesn't protect a device that is already compromised.

What the service can see

Your account details: name, email, password hash or Google/Discord sign-in (including the tokens those services return), passkey public keys, and sessions with their IP address and browser details.
Which vaults belong to your account; vault and note IDs; how many notes each vault has and their encrypted sizes; revision numbers; when notes change; and the IP address and time of requests, including sync and Windows update checks.

It can't read your note titles, text, folders or Trash state.

What is kept

The service keeps earlier encrypted versions of a note until a daily cleanup removes them once they are more than 35 days old. Kithnote has no way to browse or restore them. Notes in Trash stay in the cloud vault: the only way to remove a note from the cloud is to delete the vault. Service backups, which include account data and encrypted notes, are scheduled to expire after 35 days. A deleted vault's encrypted data is removed by the daily cleanup (large vaults can take more than one run). Local notebooks are never touched by cloud deletion.

Local vault password

By default the notebook on a device isn't encrypted. In the browser, notes and your connection kit are stored readable in the browser's site storage. On Windows, notes are readable files, and the kit is protected only by your Windows account. Anyone or anything that can use your browser profile or Windows account can read them. To protect it, open Settings, then Security, then Vault encryption.

Choose a password

Enter a password of 12 to 1024 characters and type it again under Confirm password.

Acknowledge

Tick "I understand there is no password reset. Losing my password can make this local notebook unrecoverable."

Encrypt

Choose Encrypt this device.

There is no password reset

Your vault password stays on your device. Nobody, including Euphoric Software, can reset or recover it. If you lose it, the notes in that vault can't be recovered. A saved connection kit or another unlocked device may still have your already-synced notes.

The password is turned into a key with PBKDF2-SHA256 (600,000 iterations), and the notebook is encrypted with AES-256-GCM.
Notes, titles, folders, Trash, settings and sync credentials are encrypted on the device.
The password is never sent to the sync service, and each device can use a different password; the password isn't synced.
After 5 minutes of inactivity the notebook locks. It also locks when Windows locks or the PC sleeps (Windows app) and when a browser tab is restored from history. Lock it yourself with Lock notebook now or Ctrl Shift L. The unlock screen asks for your Vault password.
You can use Change vault password (you need the Current password).
Export encrypted backup saves an .enotes file, and Import notes from encrypted backup reads it. A backup keeps the password it was made with.
Export Markdown (decrypted) saves readable, unencrypted files.

The vault password doesn't protect a notebook from malware while it is unlocked. Old unencrypted copies can remain in exports, system or OneDrive backups and version history, a notebook folder you moved away from, browser storage, or on a solid-state drive. If your Documents folder syncs to OneDrive, your readable notes are uploaded there. Your browser's history can record the titles of notes you opened.

Your account password is separate from your vault password.

Privacy

Kithnote is made by Euphoric Software. The beta stores your local notebook on your device, and cloud sync is optional. The privacy page says there's no advertising and no third-party analytics in the notebook, and that Cloudflare processes hosting, security, storage and email delivery for the service.

Read the full pages for the details:

Contact: [email protected].