A security claim without a threat model is marketing. This page says exactly what Skerry protects you from, what it cannot protect you from, and how the cryptography works, so you can check our claims instead of trusting them.
What Skerry protects against
- Anyone who gets your files but not your passphrase. A stolen laptop backup, a subpoenaed cloud drive, a nosy sync provider, a lost hard disk. An encrypted note is an opaque sealed envelope: title, tags, dates, and body all live inside the ciphertext, and the file is named by a random id. Encrypted backups and sync objects are sealed the same way before they leave the device, so your own storage only ever holds ciphertext under opaque names.
- Password-guessing at scale. The master key is wrapped by a key derived from your passphrase with Argon2id, a memory-hard function that makes GPU and ASIC guessing enormously more expensive than older derivations. Older libraries upgrade automatically on their next unlock.
- Tampering. Every sealed object is authenticated AEAD, AES-256-GCM by default with ChaCha20-Poly1305 as a choice. A modified note, backup, or sync manifest fails to open rather than opening wrong.
- Us. Skerry has no servers, no accounts, and no telemetry. There is nothing to breach on our side and nothing for us to hand over.
- Shoulder time on an unlocked device. Per-note locks behind Face ID or Touch ID, auto-lock timers, an app-switcher privacy cover while the vault is open, and clipboard copies from encrypted notes that expire after a minute.
- Coerced unlocks, within limits. An optional decoy passphrase opens a separate, innocuous library from the same prompt, and an optional erase-after-failures setting destroys this device's vault key after repeated wrong guesses. The erase is local: copies of the keyfile on your own backups or sync storage remain, protected by your passphrase.
What Skerry cannot protect against
- A compromised device. Malware with your session, a keylogger, or an attacker using your unlocked phone can read what you can read. No app survives a hostile operating system.
- A weak or reused passphrase. Argon2id slows guessing; it cannot make a guessable passphrase strong.
- Losing both the passphrase and the recovery code. There is no reset, because a reset path for you would be a back door for everyone else.
- Traffic analysis of your own storage. A sync remote learns that encrypted objects change and roughly when. It never learns names, titles, or contents.
- Notes you choose not to encrypt. Plain notes are plain Markdown files on your disk, by design. Encrypt the ones that matter, or use encrypted backups so every copy that leaves the device is sealed.
How the cryptography works
A random 256-bit master key encrypts your notes with AES-256-GCM. That master key is itself wrapped by a key derived from your passphrase with Argon2id (RFC 9106: 64 MiB, 3 passes, 4 lanes), and stored in a keyfile beside your notes. A recovery code is a second, independent wrapping of the same master key. Changing the passphrase re-wraps one key instead of re-encrypting your library. Attachments in encrypted notes are sealed under the same master key. Backups and sync objects are sealed before upload; the sync file listing itself travels inside a sealed, authenticated manifest.
The search index never stores encrypted note content. While the vault is unlocked, encrypted notes are searched through an index that lives only in memory and vanishes on lock. The passphrase is held in a zeroizing buffer and wiped when the vault locks. Server credentials for backup and sync, the URL included, live only in the device Keychain, never in settings files, and you can skip giving Skerry a login entirely by mounting the server in Files or Finder and syncing through the folder.
Check it yourself
The note format and the entire cryptographic core are open source, with the format documented in plain language and the Argon2id implementation gated on the RFC's own test vectors. Read the code, run the tests, or write your own client: github.com/kordloom/skerry-format.
Found a weakness? Tell us at hello@skerrynotes.com. We will credit you and fix it.