Encryption

Why sensitive data needs clear boundaries

What you put in Nokuo isn't ordinary notes — it's sensitive data: API keys, database passwords, SSH private keys, cloud credentials, CI tokens. A single leak can mean a production database dumped, a server compromised, a cloud bill drained, or a code repo wiped.

Password managers stuff these into a "secure note" text box — it can store them, but it isn't designed for the lifecycle of sensitive data. Tools like Notion are better suited to general content, not sensitive credentials; if you put keys there, you need to accept the cloud-side trust boundary yourself.

Nokuo's principle is clear boundaries:

• Local-first encryption: sensitive data is ciphertext before it leaves your device.
• Service stores no plaintext: the Nokuo service only sees encrypted Vault files and cannot decrypt content.
• Only you hold the keys: the master password and recovery key are known only to you; the service doesn't store them.
• Unrecoverable: losing both the master password and recovery key makes content unrecoverable — that's the price of a stronger security boundary.

Encryption order

Nokuo's default order is local encryption first, then sync or backup:

1. Create or open a local Vault.
2. The master password derives a master key locally with Argon2id.
3. The Vault manifest is encrypted with the master key.
4. Each resource is encrypted with its own resource key.
5. Each resource key is wrapped by the master key.
6. Sync and backup process encrypted Vault files.

Algorithms

• KDF: Argon2id. The master password derives the master key via Argon2id, resistant to brute force.
• Content cipher: XChaCha20-Poly1305. An AEAD stream cipher with an authentication tag and a 192-bit nonce, so nonce reuse is not a practical concern.

Key model

• Master key: derived from the master password; wraps every resource key.
• Resource key: a separate key per resource, so compromising one resource does not expose others.
• Master-key wrap: resource keys are encrypted by the master key and stored in the Vault manifest.

Zero-knowledge boundary

The Nokuo service only ever sees encrypted Vault files. It does not store:

• plaintext master password or plaintext master key
• plaintext resource keys
• plaintext configs, keys, or content

The service manages accounts, login sessions, licenses, plans, and required metadata. It does not participate in decryption.

Unrecoverability

Losing both the master password and the recovery key makes content unrecoverable:

• The master password unlocks locally and derives encryption material.
• The recovery key is the last-resort recovery mechanism.
• The Nokuo service cannot reconstruct plaintext content for you.

Store the master password and recovery key separately, and consider offline backups.

Related docs

• Where data lives and what the service stores: Security and Data Storage
• Sync sends ciphertext only: Sync and Restore