What end-to-end encryption protects
- Note titles and rich-text content
- Images and audio recordings
- Supported sketch files and previews
- The user master key, wrapped separately for each approved device
What is not encrypted
Better Keep currently leaves labels, note colors, timestamps, pin, archive, and trash state outside the encrypted note payload. This metadata supports filtering, display, and synchronization. The security page documents the boundary so you can make an informed decision.
Device approval and recovery
Every approved device has a X25519 key pair. A recovery passphrase uses Argon2id to derive the key that protects recovery material. Losing every approved device and the recovery passphrase can make synchronized encrypted notes unrecoverable.
