If you use an account, you can optionally encrypt your cloud plans with a passphrase only you know. Encryption is off by default; turn it on only if you want it.
How it works
When you enable encryption you choose an encryption passphrase. Your plans - including their names and descriptions - are encrypted right here in your browser using that passphrase before they are ever sent to us, and we only ever store the encrypted version. Your passphrase never leaves your device.
Turn it on
- Open Control Center.
- In the Cloud Encryption card, click Enable encryption.
- Choose a passphrase (separate from your account password), confirm it, and acknowledge the backup warning.
After that, each time you sign in on a device you enter your passphrase once to unlock your plans for that session.
There is no passphrase recovery
Because only you know your passphrase, we cannot reset or recover it. If you forget it, your encrypted plans cannot be recovered by us or by anyone else. Your only way back in is a plain (unencrypted) backup file you exported earlier, so export a backup and keep it somewhere safe before and while you use encryption.
Changing or turning off encryption
From the same Cloud Encryption card you can change your passphrase at any time, or turn encryption off (which decrypts your plans back to normal cloud storage). Both require your current passphrase.
What we can still see
Encryption hides your plan contents, names, and descriptions. We can still see the limited non-content details needed to run the service - that an account has plans, how many, their approximate size, and when they were last changed. See our Privacy Policy for details.
The method (for the technically curious)
This is zero-knowledge, client-side envelope encryption. Your passphrase is run through Argon2id to derive a key that wraps a random per-account data key, and your plans are encrypted with that data key using AES-256-GCM - all in your browser. We only ever receive and store the ciphertext and the wrapped key, never your passphrase or the keys themselves, so there is no server-side key that could decrypt your plans. There is deliberately no recovery mechanism: adding one would mean holding a key that could read your data, which would defeat the purpose.