How are my notes encrypted?
- When you create the safe, Protect text generates a random 256-bit data key.
- Each note (title, text, color, pin) is encrypted with that key using AES-256-GCM, with a fresh random nonce every time it is saved. GCM also detects if the stored data was altered.
- The data key is stored only wrapped: once with a key derived from your password (PBKDF2-SHA-256, 600,000 rounds, random salt) and once with a key derived from your recovery key (about 125 bits of randomness, 200,000 rounds).
- All of this is done by the browser's built-in Web Crypto. Protect text ships no cryptography code of its own.
Changing the password re-wraps the data key; the notes do not have to be re-encrypted.
Where is the key while I work?
When you unlock the safe, the data key is kept in Chrome's session storage for the extension, which lives in memory and is never written to disk. It is removed when the safe locks (after the time you choose, when the computer locks or sleeps, or with the lock button) and when the browser closes.
Can the extension send my notes anywhere?
No. The content security policy forbids every network connection (connect-src 'none'), and the
extension does not ask for access to any website. There is no Cresotech server, no analytics and
no account. Chrome itself updates the extension from the Chrome Web Store, as it does for every
extension.
Which permissions does it ask for, and why?
| Permission | Why Protect text needs it |
|---|---|
storage | keep your encrypted notes and settings on your computer |
unlimitedStorage | let a large notebook grow beyond Chrome's default storage quota |
sidePanel | open the notepad in Chrome's side panel |
contextMenus | add Add to Protect Text and Save this page to Protect Text to the right-click menu |
alarms | lock the safe after the time you choose |
idle | lock the safe when your computer locks or goes to sleep |
When you install it, Chrome shows no warning about reading your data on websites, because Protect text asks for none.
What Protect text cannot protect
Encryption protects notes at rest. Be honest with yourself about the rest:
- An open safe. Until it locks, anyone at your computer can read it. Use a short auto-lock time on a shared computer and press the lock button when you leave.
- Malware. A keylogger or a malicious program on your computer can see what you type and what is on screen. No notepad protects against that; keep the system updated.
- Weak passwords. If someone copies the encrypted data, a short or common password can be guessed offline. Use a long passphrase; the built-in generator helps.
- Plain copies. A note you download as .txt, print or copy elsewhere is no longer encrypted. The clipboard is cleared 30 seconds after you copy hidden text, but other copies are up to you.
- Hidden text blurs text on screen. It is a privacy screen, not extra encryption.
- Losing both secrets. Without the password and the recovery key, the notes are gone for good. Nobody, including Cresotech, has a back door.
Is the backup file safe?
Yes: it contains the notes in encrypted form plus the wrapped key, the same as on your computer. Without your password or recovery key it is unreadable. Still keep it somewhere private, and keep in mind that an old backup opens with the password that was valid when you made it.
How do I delete everything?
Delete notes and empty the Trash, or remove Protect text from Chrome: its storage is deleted with it. Backup files you saved yourself are not touched; delete them like any other file.
More detail: Protect text privacy policy.