How Vaultifier Protects Your Entries (Technical Overview, Simplified)
A lot of privacy pages tell you an app is "secure" and stop there. This one won't. Here's exactly what happens to your writing from the moment you hit save, in plain language, with the actual mechanics behind it.
Two security modes, one choice
Vaultifier gives you two ways to encrypt your entries, and you pick which one fits how you write.
Normal Security (system-provided key)
This is the default for new accounts. Vaultifier generates an encryption key, stores it securely on the server, and uses it to encrypt and decrypt your entries as needed.
Your entries are encrypted, protecting them from outside attackers and data breaches.
Vaultifier's systems retain the technical ability to decrypt entries — there's no external key you have to remember, which means account recovery (like a forgotten password) doesn't cost you your writing.
This mode is built for everyday journaling where convenience and recoverability matter as much as maximum privacy.
Zero-Knowledge (password-based key)
This is a Premium feature, and it works fundamentally differently:
Your password is run through PBKDF2 with 600,000 iterations of SHA-256, a deliberately slow process designed to make brute-force password guessing computationally impractical.
That produces a master key that is never stored anywhere, in any form — not in a database, not in a log, not in a backup.
The master key wraps (encrypts) a separate key for each individual vault you create, so your vaults are cryptographically independent of each other.
Those vault keys then encrypt your actual entries using AES-GCM with 256-bit keys, done entirely through your browser's built-in Web Crypto API.
The result: the encryption and decryption both happen on your device. Vaultifier's servers only ever see already-encrypted data — never your password, and never your plaintext entries.
Why vaults are separated, not just entries
Each vault — think of it as a locked folder for a topic, mood, or project — has its own independent key. This isn't just an organizational nicety. It means:
Compromising the key for one vault doesn't expose any other vault.
You can genuinely segment sensitive writing (say, therapy notes) from lower-stakes writing (say, a travel log) with real cryptographic separation, not just a UI folder structure.
Switching modes without losing your history
If you start on Normal Security and later upgrade to zero-knowledge (or the reverse), Vaultifier re-encrypts your existing entries in the background, with progress tracking, rather than requiring you to export and re-import everything by hand. Your writing history carries forward regardless of which mode you're on when you wrote it.
What this means for account recovery
This is the honest trade-off, and it's worth stating plainly rather than glossing over:
On Normal Security: if you forget your password, Vaultifier can help you regain access, because the server holds the key independent of your password.
On Zero-Knowledge: if you forget your password, there is no recovery path for existing entries. The master key was derived only from that password and was never stored — which is precisely what makes the mode zero-knowledge in the first place. Losing the password means losing the ability to derive the key, full stop.
If you choose zero-knowledge mode, treat your password like the only copy of a physical key: back it up somewhere secure (a password manager, for instance), because there's no spare hidden anywhere on Vaultifier's end.
Beyond encryption: the rest of the security picture
Encryption is the core of it, but a few other details matter for day-to-day trust:
Entry locking: individual entries can be locked to require re-authentication before they can be edited, adding a layer of friction against casual snooping on a shared or unlocked device.
Soft delete before permanent delete: deleting an entry moves it to trash first, where it can be restored; force-deleting from trash is the only step that's truly permanent. Nothing disappears by accident.
No tracking, no data mining: Vaultifier's business model is subscription-based (the Premium plan), not advertising-based — there's no structural incentive to monetize what you write.
The short version
Your entries are encrypted either way. The real question Vaultifier lets you answer for yourself is who holds the key — the server, for convenience and recoverability, or only you, for a system where even Vaultifier itself has no path to your plaintext. Both are legitimate choices depending on what you're writing and how much you're willing to trade convenience for certainty.