Security

Encrypted on your device

These are encrypted in your browser before upload. Our servers only hold the ciphertext.

• Note content, including text extracted from images
• The values of your vault fields, such as passwords and other secrets
• AI prompt text
• The contents of attached files
• The content of notes you share by link

What our servers can read

Some information is stored unencrypted so Memento can sign you in, sync, sort and organize your data:

• Your account email, your password as an Argon2id hash, and your account's public key
• Your devices' names, types, public keys and approval status; passkey public keys; and two-factor and sign-in provider settings if you use them
• Note titles (stored unencrypted for listing and sorting), tags, folder names and structure, links between notes, and timestamps
• Vault item names, types and field labels
• Prompt titles, descriptions, categories and tags
• Attachment file names, types and sizes
• Saved links: URL, title, description and preview image. Our server fetches link previews for you.
• Notes created by email-to-notes or saved from the browser extension (beta), which are stored unencrypted
• Activity logs, including IP address, browser user agent and the titles of notes you change

Keys and algorithms

• Content is encrypted with XChaCha20-Poly1305 (libsodium), with a fresh random 24-byte nonce every time.
• Each item has its own random 32-byte key. That key is wrapped with your account key using XSalsa20-Poly1305 (libsodium secretbox).
• Your account key is 32 random bytes generated on your first device. It is not derived from your password.
• On each device, the key is kept in the browser's IndexedDB, wrapped by a non-extractable WebCrypto AES-GCM key.
• A new device generates its own X25519 key pair. A device you already use seals the account key to it (libsodium crypto_box_seal). Our server only stores public keys and sealed keys, and both screens show a matching device code before you approve.
• Your password is sent over HTTPS when you sign in and stored only as an Argon2id hash (libsodium crypto_pwhash_str with moderate limits: 3 passes, 256 MiB of memory). It isn't used to derive your encryption keys.

If you forget your password

• Reset it from the sign-in page. We email you a 6-digit code that expires after 15 minutes.
• Your encryption key isn't derived from your password, so a reset doesn't touch your encrypted content. Devices you've already set up keep decrypting as before.
• A new device, or a browser where you cleared site data, must be approved from a device that still holds your key, in Settings → Device Access.
• If you lose every device that holds your key, we can't recover your encrypted content. Our servers never hold that key in a form we can use.

Sessions and sign-in

• Signing in issues a 15-minute access token and a 30-day refresh token. The refresh token is replaced every time it's used.
• You can sign out one device in Settings, or every device at once from your Profile.
• Memento locks after 15 minutes of inactivity by default. You can pick 5, 15, 30 or 60 minutes, a custom time, or never, and unlock with a passkey.
• Sign-in is limited to 5 attempts per 15 minutes from one network address, account creation to 20 per hour, and verification or reset emails to one per minute.
• We email you when a new device signs in to your account, with its name, type and IP address, and we notify your old address if your account email changes.

Sharing a note

• Your browser generates a random 32-byte key, re-encrypts the note with it and puts the key after the # in the share link. Browsers don't send that part of an address to servers, so we store only the re-encrypted copy.
• Links can expire after 1 hour, 24 hours, 7 days (the default) or 30 days, or never. An optional password is stored only as a bcrypt hash.
• Anyone with the complete link, and the password if you set one, can read the shared note.

Link previews

When you save a link, our server fetches the page to build its preview. It resolves the address first and refuses private, loopback, link-local and cloud-metadata addresses, gives up after 10 seconds and reads at most 5 MB.

Activity log

Security-relevant events go into an activity log you can review in the app. Each entry is hashed with SHA-256, chained to the previous entry's hash and signed with HMAC-SHA256, so changes to past entries can be detected.

Transport and browser protections

• All traffic uses HTTPS. Our API sends Strict-Transport-Security for 2 years, with includeSubDomains and preload.
• The website can't be framed by other sites (X-Frame-Options: DENY), disables MIME sniffing, and turns off camera and geolocation access. Microphone access is limited to Memento itself, for voice notes, and your browser asks before it's used.
• API responses carry a restrictive Content-Security-Policy, and JSON request bodies are capped at 100 KB on most endpoints.

Audits

Memento hasn't had a third-party security audit yet. If you find a security issue, please email info@mementosite.me.