How your notes are kept safe
Your notes are locked on your own phone or computer before they're synced. Our server only ever holds the locked copy, so we can't read your notes, and neither could anyone who broke in.
What happens when you sync
- Locked on your device. Your six-word phrase makes a lock key on your device. Your notes are locked with it before they leave, and unlocked only on devices where you've signed in.
- Your phrase stays with you. The server never sees it. It gets a separate access key, worked out from your phrase, that only lets it find your locked copy.
- Slow to guess. Working out the keys takes a deliberately slow calculation. It's a fraction of a second when you sign in, and a very long job for anyone trying phrases one after another. The server also limits how fast anyone can try.
- HTTPS only. Every connection is encrypted, and browsers are told never to connect to washinotes.com any other way.
Getting things back
- Every delete comes with Undo, including emptying the Trash.
- The Trash keeps notes for 7 days.
- Synced notes keep one earlier copy for each of the last 30 days, which you can restore from Settings.
- Back up saves a file you keep. On iPhone it can go to Files, iCloud Drive or Google Drive.
Keep your phrase somewhere safe
Because only your phrase can open your notes, we can't reset it for you. Save it in your password manager, or write it down and keep it with your important papers. Signed-in devices can show it again any time under Your account.
What we keep
No ads and no tracking. We only count visits, with no cookies. You don't need an account to start; notes stay in your browser until you choose to sync. Full details are in privacy and terms.
The details
Notes are locked with AES-256-GCM. The lock key and access key come from your phrase through PBKDF2 with SHA-256 and 250,000 rounds. The server files your copy under a fingerprint of the access key.