Boring, well-vetted, no custom crypto.
Every primitive is a published RFC implemented by an audited library — RustCrypto on desktop, libsodium-equivalent elsewhere. No client ships a hand-rolled primitive; cross-implementation byte-compatibility is pinned by a public test-vector repo.
RFC 9106. ~1 s on a 2024 laptop. Parameters live in vault.meta, bound into the AEAD AAD against downgrade.
RFC 8439 extended-nonce, wrapped in the CTX commitment construction to close partitioning-oracle attacks on weak passwords.
Used only as an encoding. The phrase feeds Argon2id directly — not BIP-39's weak 2048-iteration PBKDF2 seed.
HKDF-SHA-256 derives every subkey through one canonical helper with registered context strings. All randomness from the OS CSPRNG.
A random root key, wrapped two ways.
The root key is 32 random bytes — never derived from the password. Two independent credentials each wrap their own copy, so either opens the vault, and a password change re-wraps one 64-byte field instead of re-encrypting every note.
What lands on disk is noise.
Each note is a flat <uuid>.myn file. Folders are virtual — the hierarchy is a path string inside the encrypted frontmatter, so a filesystem observer sees only opaque blobs. The on-disk layout:
A successful decrypt commits the encryptor to the protocol version, the itemsKey identity, the note UUID, and the content type — substitution, downgrade, and key-confusion all fail the single constant-time CTX tag check.
An identifier, not a key.
A Mullvad-style self-generated number replaces email at signup. Possessing it grants no read access — only the password or recovery phrase derive the root key. Its hash is mixed into the Argon2id salts to prevent cross-account precomputation.
Bearer-token semantics: treat it like cash. The Damm-32 check catches every single-character substitution and every adjacent transposition.
Two ways in. No third.
The recovery phrase survives password changes — its wrapped root-key copy and salt are preserved when you set a new password. It is never sent to any server. v0.1 is hard zero-knowledge.
Lose both the password and the phrase and the vault is permanently unrecoverable. There is no forgot-password email, no admin reset, no backdoor — the deliberate cost of zero-knowledge.
What we defend — and what we don't.
Every adversary is rated against one of four honest levels. The not-protected list is published in the same document, in plain language.
Not protected against
Unrecoverable. We cannot help — no reset, no backdoor.
A keylogger reads your password; a scraper reads decrypted notes. No user-mode app defends this.
No plausibly-deniable encryption in v1. The data is exposed.
Exported markdown or PDF is ordinary unencrypted. Myne protects what it stores, not what you take out.
Read the documents.
The full normative specification, public in the repository. Changes ship as drafts with a review period before they reach production clients.