Encryption

Overview

• Local export (with password): AES-256-GCM authenticated encryption
• Key derivation: PBKDF2-HMAC-SHA256, 120,000 iterations
• Salt: 128-bit random, per backup
• Nonce (IV): 96-bit random, per backup
• Compression: gzip of JSON before encryption
• Cloud sync: gzip only (enc=none) — not encrypted

AES-256-GCM

AES-256 is the symmetric cipher used for local backup files when you set a password. GCM adds integrity: if ciphertext is tampered with, decryption fails instead of returning corrupted data.

Key derivation

Your backup password is never stored in the export file. PBKDF2-HMAC-SHA256 stretches the password with the per-backup salt to derive a 256-bit AES key. 120,000 iterations slow brute-force attempts on stolen backup files.

Cloud sync vs local export

Cloud sync uploads gzip-compressed room JSON for multi-device convenience. That payload is readable by anyone with your Room ID and access to the sync service. Use a password-protected local export when you need an encrypted offline backup.

Backup password on device

When you set a backup password in the app, it is stored sealed in Android Keystore (AES-GCM) so exports can be re-encrypted without prompting every time. Forgetting the password means encrypted backups cannot be opened — there is no recovery.