Private by design, not by promise

Most apps ask you to trust them. We built Enbox so you don’t have to — here’s what end-to-end encryption actually means for your everyday data.

Privacy policies are easy to write and easy to change. A promise on a web page does not stop anyone — an employee, an advertiser, a court order — from reaching your data if the company can technically read it. We built Enbox so that we can’t.

What “end-to-end” really means

When you save a note, upload a photo or store a password, it is encrypted on your device before it ever reaches our servers. The keys that unlock it never leave you. What we keep is an unreadable blob:

const key = await deriveKey(masterPassword, salt)
const blob = await encrypt(key, note)
// the server only ever stores `blob`

Even with full access to our database, the contents stay sealed. The lock works the same way for everyone — including us.

The three guarantees

• Your data is encrypted on your device, not on our servers
• Your keys are derived from a password only you know
• We store a locked box; only you hold the key

The most private system is one where the company cannot betray you, even if it wanted to.

The trade-off we chose

Zero-knowledge has a real cost. If you forget your password and lose your recovery key, not even we can let you back in — so we ask you to trust us hand you the keys and ask you to keep them safe. Set up recovery in advance under Settings → Security.

You can read the full security overview for the technical detail.