End-to-end vaults

Every vault is one of two kinds. You choose under Encryption when you make it with New Vault, on the web and in Papeliz for Windows:

Standard

Plain Markdown files any app can open. It’s chosen first, and it’s how every vault worked before.

End-to-end

Encrypted with a passphrase only you know. Papeliz encrypts every file on your device, and only Papeliz, with the passphrase, can open them.

1. On the start page, choose New Vault, name the vault and choose its Location. See Start or open a vault.
2. Under Encryption, choose End-to-end.
3. Type a passphrase of 12 characters or more in Vault passphrase, then again in Type it again.
4. Choose Create Vault. It stays off until the two match.

In Recent Vaults, an End-to-end vault is marked End-to-End Encryption. It asks for its passphrase when you open it, from there or with Open Vault. Unlocking takes about a second. Then it stays open until you lock it or close it, or close or reload the tab.

While it’s open, the status bar shows End-to-end with a lock: its notes are decrypted in Papeliz’s memory only. Lock Now, in the status bar and in the gear, saves every note, closes the vault and clears it from memory with its key.

Unlock has Remember on This Device, off at first. Turn it on and this device opens the vault without the passphrase, and Recent Vaults marks it Remembered. To forget the key, turn it off in the gear’s Settings › Vault, under Encryption.

• On the web, the key is kept sealed in this browser, so anyone who uses this browser can open the vault. The files stay encrypted to other apps.
• Papeliz for Windows keeps the key in Windows Credential Manager, so the vault opens without the passphrase while you’re signed in to Windows.

If you forget the passphrase, a device that remembers the vault still opens it, so you can copy your notes out there. Changing the passphrase still asks for the current one.

On your disk, or in Browser Storage, an End-to-end vault holds:

• papeliz-encrypted-files, one folder of encrypted files with random names. Each note, picture or other file is one of them, and its name and its place in the vault are encrypted too.
• .papeliz/vault-encryption.json, the vault’s encryption settings, with its key locked by your passphrase.
• About this Papeliz vault.txt, plain words saying what the folder is.

Other Markdown apps can’t read it. Inside Papeliz, links, search and pictures work as usual, and nothing decrypted is written to disk.

Open the gear’s Settings › Vault. Under Encryption:

• Change to End-to-end asks a new passphrase twice, then encrypts each file, checks it by reading it back, and removes the plain file. Copies made before, such as backups, Git history and a cloud drive’s old versions, stay readable.
• Change to Standard asks the passphrase, then writes every file back as plain Markdown, and the key this device remembered is dropped.
• Change Passphrase asks the current passphrase and a new one. No file is rewritten, and devices that remember the vault keep opening it.

Keep Papeliz open while the files change; the vault stays closed until it’s done. If Papeliz closes, it carries on from where it stopped the next time the vault opens.

• End-to-end covers the vault’s files, not what you send: the notes the assistant reads go to the provider you chose, decrypted. See Where your API key goes.
• The sample vault is never encrypted. A vault made from a template starts as Standard, and can change to End-to-end afterwards.
• Papeliz Sync is coming. It doesn’t sync End-to-end vaults yet, so pick Standard for a vault you mean to sync. See Sync your vaults.