Verus Notes

How your notes
are protected

Sync is off until you turn it on. Either way, notes are encrypted on your computer. Here's what that protects, what syncing and unlocking reveal, and where the limits are.

The cloud can't see

  • Note titles and text
  • Folder names and bookmarks
  • Exactly when you wrote or edited
  • What you search for
  • Your recovery phrase or wallet keys

If you sync, the cloud can see

  • Which VerusID signs in Stored as a keyed hash
  • How many notes and folders you sync
  • Roughly how big each note is Rounded up, 1 KB to 512 KB
  • The day a synced note last changed Not the time
  • Your IP address when you sync Like any server

Unlocking uses a signing service that sees which VerusID is unlocking, never your notes.

Every stored field, and for how long

Only your wallet can unlock it

No password to guess, phish or reset. Every unlock is a request you approve in your Verus wallet.

  1. Verus Notes asks

    The request is signed by Verus Notes' own VerusID and expires after 10 minutes.

  2. You approve in your wallet

    You see who's asking before you say yes. Your recovery phrase never leaves the wallet.

  3. Your wallet sends back a sealed key

    The key works for Verus Notes only, and is sealed so just this unlock can open it.

  4. Your notes open

    Keys stay in memory until you lock or quit. Next time, you approve again.

See the full unlock protocol

If something goes wrong

  • The cloud is hacked

    Attackers get encrypted notes and the details listed above. Without your wallet, the notes stay unreadable.

  • Your laptop is stolen while locked

    Notes on disk are encrypted. Someone could see how many there are and when they changed, but opening them takes an approval from your wallet.

  • Someone uses your unlocked computer

    They can read what you can. Lock Verus Notes when you step away. Quitting locks it too.

  • You move to a new computer

    Unlock with the same VerusID and synced notes come back. Bring local-only notes over with an encrypted backup.

  • Someone tampers with an unlock

    Services in between only pass sealed data. The app rejects any answer not signed by your VerusID for that exact request.

  • You lose your recovery phrase

    No one can reset access for you, because Verus Notes never holds your keys. Keep your wallet's recovery phrase safe.

Where the limits are

Verus Notes is in beta. These are the known gaps today.

Testnet only
Unlocking works with testnet VerusIDs during the beta.
No outside audit yet
No independent firm has reviewed the design or code.
No auto-lock
The vault stays open until you lock it or quit.
Malware
Malware on an unlocked computer can read what you can.
Backup size
A backup file's size hints at how much you've written.
Markdown export
Notes you export to Markdown are saved as readable text.
Open questions in detail