DulyNote uses industry-standard encryption to protect your data when exporting or sharing collections. Encryption is optional but strongly recommended for sensitive content.
File-Level Encryption
When you enable encryption on a .dnote export, DulyNote applies AES-256-GCM encryption to every item in the package:
- Each file and metadata record is encrypted individually.
- The encryption key is derived from your Recovery Key using PBKDF2 with a random salt.
- The salt and initialization vector (IV) are stored in the package header — the key itself is never stored.
Key Derivation
Your Recovery Key is a 32-character alphanumeric string generated at export time. The actual AES encryption key is derived from it using:
- Algorithm: PBKDF2-HMAC-SHA256
- Iterations: 100,000+
- Salt: 16 bytes, randomly generated per export
This means even if two exports use the same Recovery Key, the derived encryption keys will differ.
Transparent Archive, Encrypted Content
The .dnote package structure is readable (you can see collection names and item counts), but all content — titles, descriptions, URLs, file data — is encrypted. Only someone with the Recovery Key can decrypt and read the actual data.
- Minimal Metadata Exposure: Only non-sensitive information (such as application version and encryption status) is accessible. All user data remains encrypted during storage and transfer.
Zero-Knowledge Architecture
DulyNote follows a Zero-Knowledge security model:
- No Server Access: Encryption keys and unencrypted data are never transmitted to or stored on DulyNote servers.
- Local Key Storage: Recovery Keys are stored only in secure device storage (such as iOS Keychain or Android Keystore).
- User-Controlled Access: Only you can decrypt your data. DulyNote cannot access it under any circumstances.