--- title: "Security | Memento" description: "What Memento encrypts on your device, what our servers can read, how keys, sessions and shared links work, and what happens if you forget your password." url: https://mementosite.me/security --- [![](/logo.png)Memento](https://mementosite.me/) Features[Security](https://mementosite.me/security)[Pricing](https://mementosite.me/pricing)[Explore](https://mementosite.me/features) [Login](https://mementosite.me/login)[Register](https://mementosite.me/register) Security · how it actually works # Sealed before it leaves._Honest about what isn’t._ How Memento protects what you store, in plain language. This page describes the code as it runs today, including what isn't encrypted. [Journey](#journey)[Ledgers](#ledgers)[Keys](#keys)[Password](#forgot)[Sharing](#sharing)[Activity](#activity)[Audit](#audit) XChaCha20-Poly1305X25519 · crypto\_box\_sealArgon2idAES-GCM at rest I · The journey of one note 01 ## Your device Written in plain text, on your device. 1. ### Your device Your browser encrypts content with libsodium before anything is uploaded. 2. ### In transit Ciphertext and metadata travel to us over HTTPS. 3. ### Memento servers Store ciphertext they can't decrypt (unless you turn on easy recovery), plus the metadata listed below. Scroll to send it II · Two ledgers ## What’s sealed._And what isn’t, in writing._ ### Encrypted on your device These are encrypted in your browser before upload. Our servers only hold the ciphertext. **6** - Note content, including text extracted from images - The values of your vault fields, such as passwords and other secrets - AI prompt text - The contents of attached files - The content of notes you share by link - Backups, encrypted with your account key and saved to your device or your own Google Drive, Dropbox or OneDrive. Uploads to a drive pass through our server without being stored Hover a line to see it the way our servers do. ### What our servers can read Some information is stored unencrypted so Memento can sign you in, sync, sort and organize your data: **9** - Your account email, a hash of the sign-in hash your device makes from your password (the server never receives the password), and your account's public key - Your devices' names, types, public keys and approval status; passkey public keys; and two-factor and sign-in provider settings if you use them - Note titles (stored unencrypted for listing and sorting), tags, folder names and structure, links between notes, and timestamps - Vault item names, types and field labels - Prompt titles, descriptions, categories and tags - Attachment file names, types and sizes - Saved links: URL, title, description and preview image. Our server fetches link previews for you. - Notes created by email-to-notes, and links saved from the browser extension (beta), which are stored unencrypted - Activity logs, including IP address, browser user agent and, for searches that run on our server, the first 100 characters of the search III · The keyring ## Keys and algorithms_Your password isn’t one of them._ - Cipher Content is encrypted with XChaCha20-Poly1305 (libsodium), with a fresh random 24-byte nonce every time. - Item keys Each note, prompt and file has its own random 32-byte key, wrapped with your account key using XSalsa20-Poly1305 (libsodium secretbox). Vault field values are encrypted directly with your account key. - Account key Your account key is 32 random bytes generated on your first device. It is not derived from your password. - At rest On each device, the key is kept in the browser's IndexedDB, wrapped by a non-extractable WebCrypto AES-GCM key. If a browser can’t use IndexedDB or WebCrypto (rare), the key is kept unwrapped in local storage until it can be moved into the wrapped store. - New devices A new device generates its own X25519 key pair. A device you already use seals the account key to it (libsodium crypto\_box\_seal). Our server only stores public keys and sealed keys, and both screens show a matching device code before you approve. - Your password Your password never leaves your device. Your device turns it into a sign-in hash with Argon2id (64 MiB of memory, 3 passes, a random salt per account) and only that hash is sent, over HTTPS. The server stores only an Argon2id hash of it (19 MiB, 2 passes). The password isn't used to derive your encryption keys. - Recovery key Your recovery key is 20 random bytes, shown as a code or a 15-word phrase. A key derived from it seals your account key with XChaCha20-Poly1305; our server stores only the sealed copy, and we email you whenever it’s used. IV · If you forget your password ## Forgetting is fine._Losing every device isn’t._ 1. 01 Reset it from the sign-in page. We email you a 6-digit code that expires after 15 minutes. 2. 02 Your encryption key isn't derived from your password, so a reset doesn't touch your encrypted content. Devices you've already set up keep decrypting as before. 3. 03 A new device, or a browser where you cleared site data, must be approved from a device that still holds your key, in Settings → Device Access. 4. 04 If you lose every device that holds your key and haven't set up any of the ways back in below, we can't recover your encrypted content. Unless you turn on easy recovery, our servers never hold that key in a form we can use. ### Ways back in if you lose every device Your account key isn't derived from your password, so you need one of these to get it back. Each has a different trade-off. - Recovery key: 20 random bytes that you save yourself. Our server stores only a copy of your account key sealed with it, which we can't open. - Passkey unlock (optional): a passkey you turn on for unlocking seals your account key with a secret only that passkey can produce. We store only the sealed copy, which we can't open. Whoever controls the account your passkey syncs with, usually Google or Apple, can unlock your data with it. - Emailed recovery kit (optional): your account key encrypted in your browser with a passphrase and emailed to you. Your mail provider and anyone with access to your mailbox hold that encrypted copy, so the strength of your passphrase is the whole defence. Old kits keep working until an encryption reset. - Easy recovery (optional, not zero-knowledge): Memento holds a locked copy of your account key. It protects against our database or our key file leaking on its own, but not against a compromised server or someone who runs it, who could open the copy. Every recovery waits 12 hours and can be cancelled from any signed-in device. With two-factor sign-in on, starting one also needs your code; without it, control of your email is enough. V · Sharing a note ## The key rides after the #._Browsers never send that part._ mementosite.me/shared/**q7Lm2xVt**#**XQXBLh2rkbsmEOFRWkr+nFHma8** Your browser generates a random 32-byte key, re-encrypts the note with it and puts the key after the # in the share link. Browsers don't send that part of an address to servers, so we store only the re-encrypted copy. Links can expire after 1 hour, 24 hours, 7 days (the default) or 30 days, or never. An optional password is stored only as a bcrypt hash. Anyone with the complete link, and the password if you set one, can read the shared note. The note’s title and tags are not re-encrypted: anyone with the link (and the password, if you set one) can see them, even without the part after the #. VI · Activity log ## Every entry signs the last._Edit one, and the chain shows it._ Security-relevant events go into an activity log you can review in the app. Each entry is hashed with SHA-256, chained to the previous entry's hash and signed with HMAC-SHA256, so changes to past entries can be detected. 1. Signed in`prev 00000000 · sha256 faeebbd7` 2. New device approved`prev faeebbd7 · sha256 02f4829f` 3. Note changed`prev 02f4829f · sha256 07393116` 4. Share link created`prev 07393116 · sha256 f4692c02` 5. Signed out`prev f4692c02 · sha256 faeebbd5` VII · The rest of the field manual ## The small print,_printed large._ access token 15 min refresh, replaced on use 30 days sign-in attempts 5 / 15 min Strict-Transport-Security 2 years ### Sessions and sign-in - Signing in issues a 15-minute access token and a 30-day refresh token. The refresh token is replaced every time it's used. If a replaced refresh token is used again more than 30 seconds later, we treat it as stolen and sign that device out. - You can sign out one device in Settings, or every device at once from your Profile. - Memento locks after 15 minutes of inactivity by default. You can pick 5, 15, 30 or 60 minutes, a custom time, or never, and unlock with a passkey. - Password sign-in is limited to 5 attempts per 15 minutes from one network address, account creation to 20 per hour, and verification or reset emails to one per minute. - We email you when a new device signs in to your account, with its name, type and IP address, and we notify your old address if your account email changes. ### Link previews When you save a link, our server fetches the page to build its preview. It resolves the address first and refuses private, loopback, link-local and cloud-metadata addresses, gives up after 10 seconds and reads at most 5 MB. ### Transport and browser protections - All traffic uses HTTPS. Our API sends Strict-Transport-Security for 2 years, with includeSubDomains and preload. - The website can't be framed by other sites (X-Frame-Options: DENY), disables MIME sniffing, and turns off camera and geolocation access. Microphone access is limited to Memento itself, for voice notes, and your browser asks before it's used. - API responses carry a restrictive Content-Security-Policy, and JSON request bodies are capped at 100 KB on most endpoints. VIII · Audits ## No auditor’s stamp yet._So we told you first._ Memento hasn't had a third-party security audit yet. If you find a security issue, please email [security@mementosite.me](mailto:security@mementosite.me). For questions about how we handle your data, write to [trust@mementosite.me](mailto:trust@mementosite.me). ## Private by construction. _Honest by policy._ Free during public beta. No credit card required. [Start your workspace](https://mementosite.me/register) [![](/logo.png)Memento](https://mementosite.me/) Your thoughts, encrypted and organized. The workspace that puts your privacy first. Public beta ## Product - [Features](https://mementosite.me/features) - [Security](https://mementosite.me/security) - [Pricing](https://mementosite.me/pricing) ## Company - [About](https://mementosite.me/about) - [Blog](https://mementosite.me/blog) - [Contact](mailto:support@mementosite.me) ## Legal - [Privacy Policy](https://mementosite.me/privacy) - [Terms of Service](https://mementosite.me/terms) © 2026 Memento [support@mementosite.me](mailto:support@mementosite.me) Back to top