Understanding end-to-end encryption

Your notes and attachments are encrypted on your device before sync. Notance does not hold your decryption key in clear text.

1. 1
   You unlock your notes

   Your password is transformed on your device by Argon2id. It is never sent to Notance.

2. 2
   Two separate keys

   A standard function (HKDF-SHA256) derives two keys from the result: one proves your identity when you sign in, the other, the protection key, never leaves your device.

3. 3
   Your device encrypts before sending

   Contents are encrypted with a random data key, which is only synced in encrypted form.

4. 4
   Your devices open your contents

   Once unlocked, your devices use your key to display your notes and attachments. The server stores only their encrypted version.

Password derivation

Argon2id3 passes, 64 MiB of memory, 4 lanes, 256-bit output

Key separation

HKDF-SHA256Two 256-bit keys with distinct domains

Content encryption

AES-256-GCMRandom 96-bit initialization vector for each operation

Data key

Random, 256 bitsWrapped by the protection key and by the recovery key

• Note contents and titles, their folder organisation, and synced preferences and indexes.
• Attached images and PDFs: their contents, filenames and precise file types.

The rest of your data (account, sign-in, billing, security) is also encrypted on Notance’s servers and is used to run your account. The privacy policy explains this processing.

See where your notes are stored →

Read the privacy policy

Keep your recovery key somewhere safe, separate from your Notance account. If you need to reset your password by email, your account must have an active recovery key. Changing your password and opening your notes are two separate steps: the guide walks you through recovery using your old password or recovery key, depending on your situation.

Regain access to your notes →

To keep your notes private while reading, lock your device when you step away and use an up-to-date Notance app from a trusted source.