Only you can read your notes.

Your notes are encrypted on your device before they ever leave it, using a key made from your password that we never receive. On our servers, in your browser's storage, and everywhere in between, your notes exist only as unreadable code.

They become readable in exactly one place: on your screen, the moment you're reading them. They're never written to disk in the clear — not on our servers, not on your own machine.

That's why no one at VaultWeb can read your notes, no one holding your laptop can, and no one who breaks into our servers gets anything but noise. It isn't a promise we're asking you to trust. It's how the software is built — and you can watch it happen, in your own browser, in about thirty seconds.

See for yourself

You don't have to take our word for it. Open your browser's developer tools and watch:

1. Open any note in VaultWeb.
2. Open developer tools — press F12, or right-click and choose Inspect — and click the Network tab.
3. Type a few words. Watch the save request go out. What leaves your browser is a block of ciphertext, not your words.
4. Now open the Application tab and look at where VaultWeb caches notes for offline use (IndexedDB / local storage). Same thing there: unreadable blobs, not Markdown.

That's your notes leaving your device — and resting on it — as encrypted bytes. The only place they're ever readable is on the screen in front of you.

Even on your own device

Most encrypted apps protect your notes in transit and on their servers, then quietly keep a readable copy on your machine “for convenience.” We don't.

The cache on your device holds the very same encrypted bytes as our servers. Lose your laptop, hand it to a repair shop, sync it to a backup, get hit by malware — the files on disk are unreadable. They're decrypted only in memory, only while you're looking at them, and never written back to disk in the clear.

For someone who works on machines they don't fully control, that's the whole point.

How sharing works without us reading your notes

Sharing looks like it should break the promise: if only you can read your notes, how can you send one to someone else? The answer is that the keys travel where our servers can't follow.

Public links. When you create a public link, the note's decryption key is placed inside the link itself — in the part after the #, which browsers, by design, never send to any server. We store only the encrypted note and an encrypted title. Whoever opens the link decrypts it in their own browser, using the key in the link. We never see the key, the title, or the contents — even for a note you've deliberately made public.

Sharing with a person. Every VaultWeb account has its own key pair. When you share a note or a team vault with someone, your browser seals the note's key so that only their key can open it, then hands us the sealed result to pass along. We relay an envelope we can't open. Remove someone's access and the key is rotated, so an old copy is useless.

Either way, the rule never changes: our servers move sealed envelopes, and can't read what's inside.

What happens if you forget your password

Here's the honest tradeoff — and it's the clearest proof the encryption is real.

We can't reset your password, because we don't have your key. A company that can reset your password is a company that can read your data. We can do neither.

So when you sign up, VaultWeb gives you a one-time recovery key. Save it somewhere safe — a password manager, a printout, wherever you keep things that matter. If you ever forget your password, that key restores your access. It's the one way back in, and only you hold it.

No backdoor for us. No lockout for you — as long as you kept your key.