Security
What protects your vault — and what doesn’t
Where your vault lives
In this browser, on this device. Memory text, titles, tags, project names, filenames and search indexes are never sent to Droidex servers — not even encrypted.
How it will be encrypted
Using your browser’s built-in Web Crypto: a random 256-bit vault key encrypts each record with AES-256-GCM. That key is wrapped by a key derived from your passphrase (PBKDF2-HMAC-SHA-256, at least 600,000 iterations). Passphrases need at least 14 characters.
Locking
The vault locks after inactivity (default 5 minutes), when you press Lock, and on every page reload. Locking clears decrypted data from the page.
Recovery
There is no server copy and no “email me my key”. If you lose your passphrase and don’t have a backup file plus its passphrase, Droidex cannot recover your vault.
Backups
An encrypted .droidex file you download and keep. It has its own passphrase. Changing your vault passphrase later does not change old backups.
What this does not protect against
Malware on your device, compromised browser extensions, screenshots, text you copy or export yourself, or malicious code running while the vault is unlocked. Clearing browser data can delete the working vault.
Review status
This is a proposed baseline. It has not been independently audited. We make no certification claims.
Stay updated
Get occasional news about Droidex launch and releases. Only your email address is stored — never anything from your vault.