At a glance
Your notes are encrypted and decrypted only in your browser, through the Web Crypto API. The server stores and relays ciphertext, and holds no key that opens it.
| Purpose | Primitive | Parameters |
|---|---|---|
| Notes, titles, tags, edits, history | AES-256-GCM | 256 bit keys, random 96 bit nonce, 128 bit tag |
| Password stretching | PBKDF2-HMAC-SHA-256 | 600,000 iterations, random 128 bit salt |
| Key splitting and wrapping | HKDF-SHA-256 | 256 bit outputs, one label per purpose |
| Sharing and device links | ECDH on P-256 | An ephemeral key pair per wrap |
| Credential storage on the server | Argon2id | 19 MiB memory, 2 passes, parallelism 1 |
| Session tokens | Random bytes, stored as SHA-256 | 256 bits |
Encryption and keys
Your browser generates a random 256 bit master key at sign-up and holds it as a non-extractable key. The server receives it only wrapped. Each note's text, title and tags, every edit and every saved version are sealed with AES-256-GCM under a random 256 bit key.
Ciphertext is not padded, so the server sees each note's size, along with its timestamps and members. Search runs on your device, the only place your notes are readable.
Passwords, recovery key and passkeys
Your password never leaves your device. The browser derives two keys from it: one to sign in, which the server hashes again with Argon2id, and one to wrap your master key, which is never sent. The recovery key is 256 random bits, shown once and derived the same way. There is no reset by email. Passkeys use WebAuthn. Signing in with one also unlocks your notes, through the WebAuthn PRF extension.
Sessions
Astro Notes sets no cookies. A session is a random 256 bit token in the Authorization header,
stored on the server only as a SHA-256 digest. It ends after 30 minutes idle or 30 days at most.
Sign-in is rate limited per address and per account.
Sharing
Sharing wraps the note's key to each member's public key with ECDH on P-256. Removing a member replaces the key and reseals the note. Live collaboration seals Yjs updates and cursor positions under the note's key, and the server relays them without decrypting them. Public keys come from the server, and the app does not yet offer an out-of-band fingerprint check.
Command bridge messages are sealed too, but the server decides who is a member.
Transport and browser
Connections use TLS 1.3 only, with Strict Transport Security for two years. Every page carries a
Content Security Policy with no inline exceptions and no eval. There are no third-party scripts,
fonts, trackers or advertising. The tour films stream from Mux, and nothing is fetched from it
until you press play.
Hosting and backups
Astro Notes runs on a Debian server at Hetzner in Germany. The Rust API forbids unsafe code and runs sandboxed. Row-level security scopes each database transaction to the account making the request. Releases are signed with Sigstore and verified before they run. Daily backups are encrypted with age and kept up to 30 days, and a restore never brings back an erased account.
Logging
The web server keeps each request's address, path and status for 30 days, with headers, secrets and email addresses removed. The API logs no IP addresses. Errors reach New Relic through our server, without your IP address or account. No third-party analytics service is used.
Payments and email
Orbit is paid through Stripe, and card details never reach our servers. Email goes through Maileroo over SMTP with STARTTLS. A share notice names only the sender, never the note's title or content.
Account deletion
Deletion asks for your password or recovery key, then erases the account, its notes, sessions and passkeys in one database transaction. Stripe deletes the customer record too.
Responsible disclosure
If you find a vulnerability, please report it privately to
hello@astronotes.eu. You can encrypt your report to our
PGP key, fingerprint
1892 F958 DED2 DD73 B142 C26F 0B36 1D10 E45A 4508. The same details are in our
security.txt. Thank you for helping us keep Astro Notes safe.