Notes that only you can open.
Encrypted on this device with a password that never leaves it. No account, no server, nothing to breach.
Notes are sealed with AES-GCM-256. The key comes from your password through PBKDF2-SHA-256 with 600 000 iterations and a random salt, and everything is stored only in this browser's IndexedDB.
How the vault works
Everything below runs inside your browser using the WebCrypto API. The parameters are the same ones written into every exported backup, so you can check them yourself.
What it can't do: protect you from malware or a hostile browser extension while the vault is open, from a weak password, or from losing the only copy of your notes. JavaScript can't guarantee that memory is zeroed, so on lock the app drops every reference and lets the garbage collector reclaim it.
Your password becomes a key
The master password and a random 16-byte salt go through PBKDF2-SHA-256 for 600 000 iterations. The result is a 256-bit key-encryption key that exists only in memory. The password itself is never written anywhere.
That key opens the vault key
When the vault is created, a random 256-bit vault key is generated and wrapped with AES-GCM under the key from your password. A small verifier, a known phrase sealed the same way, tells the app whether the password you typed is right, without storing the password.
Every note is sealed on its own
Each save encrypts the whole note (title, body, tags, pin) with AES-GCM-256 and a fresh 12-byte IV. Only the ciphertext, the IV and a timestamp are written to IndexedDB. The GCM authentication tag means a tampered note is rejected rather than shown.
- Key derivation
- PBKDF2-SHA-256
- Iterations
- 600 000
- Salt
- 16 random bytes per vault
- Cipher
- AES-GCM, 256-bit key
- IV
- 12 random bytes per encryption
- Authentication tag
- 128 bits, checked on every read
- Randomness
- crypto.getRandomValues
- Storage
- IndexedDB, database "vaultmemo", this origin only
- Master password
- never stored; checked through the verifier
- On lock
- keys and plaintext dropped from memory
- Network
- none; works offline after the first load
What the vault does for you
Encrypted before it is written
Each note is sealed with AES-GCM-256 and a fresh 12-byte IV on every save. IndexedDB only ever receives ciphertext, the IV and a timestamp; the title is encrypted too.
Locks itself
Idle for 1, 5, 15 or 30 minutes and the vault locks; you can also lock it whenever the tab is hidden, or with one click in the header. Pending text is saved first, then keys and plaintext are dropped from memory.
Your backup is one file
Export a .vaultmemo file with the salt, wrapped key, verifier and every note as ciphertext. Restore it in any browser with the master password, or merge it into another vault. Plain Markdown export exists for the day you leave.
Search without a server
Search runs over the decrypted titles, text and tags held in memory while the vault is open, so nothing searchable is ever written to disk. Pin what matters, preview Markdown, count words.
An encrypted notebook, explained plainly
VaultMemo is an encrypted notes app that runs entirely in the browser. There is no account to create and no server that ever sees your text: you choose a master password, the app derives a key from it with PBKDF2-SHA-256 (600 000 iterations and a random salt), and every note is encrypted with AES-GCM-256 before it is stored in your browser's IndexedDB. The password itself is never written anywhere; a small encrypted verifier is used to tell whether the one you typed is right. Unlocking decrypts your notes into memory, where you can search, edit, pin and tag them, and locking, whether by hand, after idle minutes or when the tab is hidden, drops the keys again.
Keeping everything local changes who is responsible for what. Nobody can reset the password for you, and clearing site data removes the vault, so backups matter: the encrypted .vaultmemo export is a single file you can keep on any disk or drive and restore in another browser with the same password, and a plain Markdown export exists for moving on. The editor understands a small, predictable subset of Markdown (headings, bold, italic, lists, quotes and code) and shows a word count. The whole site is static, loads no third-party scripts and makes no network requests after the page arrives, which you can confirm in your browser's network inspector.
Guides
Plain-language explainers on the encryption, the master password and what keeping data on your own device really means.
How AES-GCM and PBKDF2 protect your notes
Two standard algorithms do all the work: one turns your password into a key, the other seals each note. What they guarantee, and where that stops.
6 min read
Choosing a master password you can remember
The master password is the one secret VaultMemo cannot recover for you. How to make it strong and memorable: entropy arithmetic and diceware passphrases.
6 min read
Local-first apps and your privacy
No account, no server, no sync: local-first removes whole categories of risk and adds new duties. What IndexedDB is, when browsers evict it, and backups.
6 min read
Questions people ask
Are my notes uploaded or synced anywhere?
No. VaultMemo is a static page with no backend: there is no account, no server-side storage and no sync. Notes are encrypted in your browser with the WebCrypto API and written to your browser's IndexedDB as ciphertext. After the page has loaded, the site makes no network requests at all, which you can verify in the Network tab of your browser's developer tools, and it keeps working offline.
What happens if I forget the master password?
The notes stay encrypted and there is no way to recover them. The password is never stored, and the key that opens the vault exists only while you are typing it, so neither we nor anyone else can reset it. The only way back is a backup made with a password you remember. If there is none, the locked card offers to delete the vault so you can start a new one. Write the password down and keep it somewhere physical.
Where exactly are the notes stored?
In IndexedDB, a database built into every modern browser, in a database named "vaultmemo" that belongs to this site's origin only. Each record holds a note's ciphertext, its 12-byte IV and two timestamps; the salt, the wrapped vault key and the verifier live in a separate record. On disk this ends up inside your browser profile folder. Another website cannot read it, and anyone who copies the files gets nothing without the master password.
Will clearing browser data delete my vault?
Yes. Clearing site data, cookies and storage for this site, resetting the browser profile, or closing a private window all remove IndexedDB, and with it the vault. Browsers can also evict storage when disk space runs low unless persistent storage has been granted (VaultMemo asks for it when a vault is created). Export an encrypted .vaultmemo backup regularly; it restores the vault in any browser with the same password.
Can I use the same vault on several devices?
There is no automatic sync, by design. Export the encrypted .vaultmemo file on one device, move it any way you like (a USB stick, your own cloud folder, email to yourself; the file is opaque without the password) and restore it on the other. If both devices already have notes, import it into the open vault and choose Merge: notes are matched by id and the newer version wins, nothing is deleted.
Does the editor understand Markdown?
A small, predictable subset: headings with #, ## and ###, **bold**, *italic*, `inline code`, fenced code blocks, bullet and numbered lists, quotes with >, horizontal rules and http(s) links. Switch to Preview to see it rendered; the text itself is stored exactly as you typed it, so a plain Markdown export opens in any editor.
How does auto-lock work?
While the vault is open, the header shows a countdown. Any pointer or keyboard activity resets it; when it reaches zero (after 1, 5, 15 or 30 minutes, your choice) the vault locks. You can also enable locking the moment the tab is hidden, or press Lock at any time. Locking first saves any text still waiting for autosave, then drops the vault key and every decrypted note from memory.
How can I check that the encryption is what you claim?
Three ways. The exported .vaultmemo file is readable JSON: it names the KDF (PBKDF2, SHA-256, 600 000 iterations), the salt, the cipher (AES-GCM-256) and every note's IV and ciphertext. The site's JavaScript is served unminified enough to follow in your browser's developer tools, and all cryptography is delegated to the browser's own crypto.subtle implementation. And the Network tab shows that nothing is sent anywhere.
Is the sample vault safe for real notes?
No. The sample vault lives only in memory, uses the fixed password "sample-vault" and is discarded the moment it locks, whether by hand, by the idle timer or by closing the tab. It exists so you can see the editor, search and export without committing to a password. Create your own vault for anything you want to keep.