Security

Architecture summary · 29 August 2026

Your browser is the primary notes database. Local editing never depends on account, network, or cloud availability.

Encrypted sync

When enabled, a random 256-bit vault key encrypts each note with AES-256-GCM. A recovery-passphrase key derived with PBKDF2-HMAC-SHA-256 wraps that vault key. The server receives the wrapped key and encrypted note envelopes, not plaintext or the passphrase.

Authentication

Google OpenID Connect uses authorization code flow, PKCE, state, and nonce. Editpad verifies token signature, issuer, audience, timestamps, email verification, and nonce. Application sessions are opaque, hashed in the database, HttpOnly, Secure, and SameSite.

Application protections

Write APIs require an authenticated session, a same-origin request, and a session-bound CSRF token. Inputs and payload sizes are constrained, sync writes are rate-limited, and records are scoped by the authenticated user.

Important limitation

End-to-end encryption cannot protect a note from someone who controls an unlocked device or malicious browser extension. Losing the recovery passphrase can make synced data permanently unrecoverable.

Report a concern

Email macklpgr@gmail.com. Please do not include private note contents.