Security · how it actually works

Sealed before it leaves.Honest about what isn’t.

How Memento protects what you store, in plain language. This page describes the code as it runs today, including what isn't encrypted.

XChaCha20-Poly1305X25519 · crypto_box_sealArgon2idAES-GCM at rest

I · The journey of one note

01

Your device

Written in plain text, on your device.

  1. Your device

    Your browser encrypts content with libsodium before anything is uploaded.

  2. In transit

    Ciphertext and metadata travel to us over HTTPS.

  3. Memento servers

    Store ciphertext they can't decrypt (unless you turn on easy recovery), plus the metadata listed below.

II · Two ledgers

What’s sealed.And what isn’t, in writing.

Encrypted on your device

These are encrypted in your browser before upload. Our servers only hold the ciphertext.

6
  • Note content, including text extracted from images
  • The values of your vault fields, such as passwords and other secrets
  • AI prompt text
  • The contents of attached files
  • The content of notes you share by link
  • Backups, encrypted with your account key and saved to your device or your own Google Drive, Dropbox or OneDrive. Uploads to a drive pass through our server without being stored

Hover a line to see it the way our servers do.

What our servers can read

Some information is stored unencrypted so Memento can sign you in, sync, sort and organize your data:

9
  • Your account email, a hash of the sign-in hash your device makes from your password (the server never receives the password), and your account's public key
  • Your devices' names, types, public keys and approval status; passkey public keys; and two-factor and sign-in provider settings if you use them
  • Note titles (stored unencrypted for listing and sorting), tags, folder names and structure, links between notes, and timestamps
  • Vault item names, types and field labels
  • Prompt titles, descriptions, categories and tags
  • Attachment file names, types and sizes
  • Saved links: URL, title, description and preview image. Our server fetches link previews for you.
  • Notes created by email-to-notes, and links saved from the browser extension (beta), which are stored unencrypted
  • Activity logs, including IP address, browser user agent and, for searches that run on our server, the first 100 characters of the search

IV · If you forget your password

Forgetting is fine.Losing every device isn’t.

  1. 01

    Reset it from the sign-in page. We email you a 6-digit code that expires after 15 minutes.

  2. 02

    Your encryption key isn't derived from your password, so a reset doesn't touch your encrypted content. Devices you've already set up keep decrypting as before.

  3. 03

    A new device, or a browser where you cleared site data, must be approved from a device that still holds your key, in Settings → Device Access.

  4. 04

    If you lose every device that holds your key and haven't set up any of the ways back in below, we can't recover your encrypted content. Unless you turn on easy recovery, our servers never hold that key in a form we can use.

Ways back in if you lose every device

Your account key isn't derived from your password, so you need one of these to get it back. Each has a different trade-off.

  • Recovery key: 20 random bytes that you save yourself. Our server stores only a copy of your account key sealed with it, which we can't open.
  • Passkey unlock (optional): a passkey you turn on for unlocking seals your account key with a secret only that passkey can produce. We store only the sealed copy, which we can't open. Whoever controls the account your passkey syncs with, usually Google or Apple, can unlock your data with it.
  • Emailed recovery kit (optional): your account key encrypted in your browser with a passphrase and emailed to you. Your mail provider and anyone with access to your mailbox hold that encrypted copy, so the strength of your passphrase is the whole defence. Old kits keep working until an encryption reset.
  • Easy recovery (optional, not zero-knowledge): Memento holds a locked copy of your account key. It protects against our database or our key file leaking on its own, but not against a compromised server or someone who runs it, who could open the copy. Every recovery waits 12 hours and can be cancelled from any signed-in device. With two-factor sign-in on, starting one also needs your code; without it, control of your email is enough.

V · Sharing a note

The key rides after the #.Browsers never send that part.

mementosite.me/shared/q7Lm2xVt#XQXBLh2rkbsmEOFRWkr+nFHma8

Your browser generates a random 32-byte key, re-encrypts the note with it and puts the key after the # in the share link. Browsers don't send that part of an address to servers, so we store only the re-encrypted copy.

Links can expire after 1 hour, 24 hours, 7 days (the default) or 30 days, or never. An optional password is stored only as a bcrypt hash.

Anyone with the complete link, and the password if you set one, can read the shared note. The note’s title and tags are not re-encrypted: anyone with the link (and the password, if you set one) can see them, even without the part after the #.

VI · Activity log

Every entry signs the last.Edit one, and the chain shows it.

Security-relevant events go into an activity log you can review in the app. Each entry is hashed with SHA-256, chained to the previous entry's hash and signed with HMAC-SHA256, so changes to past entries can be detected.

  1. Signed inprev 00000000 · sha256 faeebbd7
  2. New device approvedprev faeebbd7 · sha256 02f4829f
  3. Note changedprev 02f4829f · sha256 07393116
  4. Share link createdprev 07393116 · sha256 f4692c02
  5. Signed outprev f4692c02 · sha256 faeebbd5

VII · The rest of the field manual

The small print,printed large.

access token
15 min
refresh, replaced on use
30 days
sign-in attempts
5 / 15 min
Strict-Transport-Security
2 years

Sessions and sign-in

  • Signing in issues a 15-minute access token and a 30-day refresh token. The refresh token is replaced every time it's used. If a replaced refresh token is used again more than 30 seconds later, we treat it as stolen and sign that device out.
  • You can sign out one device in Settings, or every device at once from your Profile.
  • Memento locks after 15 minutes of inactivity by default. You can pick 5, 15, 30 or 60 minutes, a custom time, or never, and unlock with a passkey.
  • Password sign-in is limited to 5 attempts per 15 minutes from one network address, account creation to 20 per hour, and verification or reset emails to one per minute.
  • We email you when a new device signs in to your account, with its name, type and IP address, and we notify your old address if your account email changes.

Link previews

When you save a link, our server fetches the page to build its preview. It resolves the address first and refuses private, loopback, link-local and cloud-metadata addresses, gives up after 10 seconds and reads at most 5 MB.

Transport and browser protections

  • All traffic uses HTTPS. Our API sends Strict-Transport-Security for 2 years, with includeSubDomains and preload.
  • The website can't be framed by other sites (X-Frame-Options: DENY), disables MIME sniffing, and turns off camera and geolocation access. Microphone access is limited to Memento itself, for voice notes, and your browser asks before it's used.
  • API responses carry a restrictive Content-Security-Policy, and JSON request bodies are capped at 100 KB on most endpoints.

VIII · Audits

No auditor’s stamp yet.So we told you first.

Memento hasn't had a third-party security audit yet. If you find a security issue, please email security@mementosite.me. For questions about how we handle your data, write to trust@mementosite.me.

Private by construction. Honest by policy.

Free during public beta. No credit card required.

Start your workspace