End-to-End Encryption Explained: Why TreeNotes Is Truly Private

When you store notes in the cloud, who can read them? With most apps, the answer is: the company that runs the servers. That might be fine for a shopping list, but for ideas, work, or anything sensitive, you deserve better. End-to-end encryption (E2EE) changes the rules—and TreeNotes is built on it from the ground up.

What "end-to-end" really means

In server-side encryption, your data is encrypted on the server (or in transit, then decrypted on the server). The server holds the keys. If someone gets into the database or the company is compelled to hand over data, your notes can be read.

Client-side, end-to-end encryption means your device encrypts the data before it's sent. Only you (and people you explicitly share with) have the keys. The server never sees your password or the keys that protect your notes. It only stores encrypted blobs it can't decipher.

You → encrypt in browser → Server (only ciphertext) → You → decrypt in browser

So even if our servers were breached or we received a subpoena, we wouldn't have your plaintext notes—we don't have the keys.

Zero-knowledge: we don't know what you write

TreeNotes is zero-knowledge. We don't store your password. We don't store the key that unlocks your notes. Everything that can decrypt your data is derived in your browser and never sent to us. That's why we can't "reset" your password to give you access: we never had access in the first place.

How TreeNotes does it

• Sign up / login: Your password never leaves your device in plain form. We only store a hash used for authentication. A separate, stronger key is derived from your password to encrypt your private key—and that encryption key never touches our servers.
• Creating and editing notes: Each note (and folder) is encrypted with its own key. Those keys are wrapped with your master key, which lives only in your browser. When you type, the app encrypts the content locally and only sends ciphertext to sync.
• Sharing: When you share a note with someone, we use your and their public keys to re-wrap the note's key so only they can unwrap it. The server never sees the actual note key in the clear.

So from creation to sync to sharing, the server only ever sees encrypted data and opaque key material. No plaintext.

Transport encryption: one more layer

TreeNotes also uses SSL/TLS (HTTPS) for every connection—the same padlock you see in your browser when you visit a bank or email provider. Here’s the thing: with E2EE, that’s not strictly necessary. We’re already sending only ciphertext; a snoop on the wire would see encrypted blobs they can’t read. We use HTTPS anyway. It’s an extra level of security—shielding connection metadata, hardening against tampering, and following the principle that good privacy is layered. Your data is encrypted when it’s stored, when it’s shared, and when it’s in transit. No single point of failure.

Why it matters

• Breach-proof: A database leak doesn't expose your notes.
• Privacy from third parties: We can't read your notes, so we can't hand them over or mine them.
• Trust through design: Your privacy doesn't depend on a policy; it's enforced by how the system is built.

If you're ready for notes that only you (and your chosen collaborators) can read, sign up for TreeNotes free and start writing with real privacy.