How your binder stays yours.
Afterwyrd holds the things people write down once and hope nobody needs: passcodes, where the will is, what to do about the dog. That is only worth doing if the company holding it cannot read it. This page explains how that works, in enough detail to check.
What we can and cannot see
Everything you write is encrypted on your own device before it is sent anywhere. What reaches our servers is a block of bytes we have no key for. We can delete it, we can tell you when it was last changed, and we can hand it back to you. We cannot open it.
We cannot see: The contents of any item, its title, its notes, your files, or which category you filed it under.
We cannot see: Your password. It is never sent to us, not even hashed — logging in proves you know it without transmitting it.
We cannot see: Your Secret Key. It is generated on your device and never leaves it.
We can see: Your email address, when you signed up, and when items were created or changed.
We can see: How many items you have, how many people are on your list, and the size of your files.
We can see: The email addresses of people you share with — we have to, in order to email them.
The second list is the honest part. Encryption hides contents, not the fact that something exists — and a product that claimed otherwise would be lying to you.
Your two secrets
Opening your binder takes two things: your password, which you remember, and a Secret Key, which your device generates when you sign up and keeps. Neither is ever sent to us. Combined on your device, they produce the key that unlocks everything else.
Two secrets rather than one, because they fail in different ways. A password can be guessed; a Secret Key cannot, but it also cannot be remembered. Needing both means a server that lies about who it is still cannot open your binder, and neither can anyone who only ever learns your password.
You can also let a passkey stand in for both, so Face ID or your screen lock opens the binder. It is off unless you turn it on, and it changes who can open your binder: anyone who can unlock a device that holds that passkey. If the passkey is saved to your Apple or Google account it is on your other devices too, including ones you add later — the settings page says which kind yours is before you turn it on. Your password keeps working everywhere, and turning it off takes the shortcut away.
Precisely: The password is stretched with Argon2id (libsodium crypto_pwhash, moderate limits), then combined with the 128-bit Secret Key using keyed BLAKE2b. Login uses OPAQUE, an authenticated key exchange in which the server never receives the password in any form.
The Secret Key is not a recovery code. It is half of the encryption key. We cannot reset it, resend it, or recover your binder without it — not for you, not for anyone claiming to be you, and not for a court. That is the property that makes the rest of this page true, and it is also the risk you take on. Keep it somewhere you will still have in ten years.
How an item is sealed
Each item gets its own key, generated on your device. The item is encrypted with it, and that key is then wrapped by your binder key. Nothing readable crosses the line between your device and our servers.
Precisely: XChaCha20-Poly1305 authenticated encryption, one key per item and one per file. Each ciphertext is bound to what it is and where it belongs — the item, its version, its purpose — so a block of bytes moved somewhere it does not belong fails to decrypt rather than opening into the wrong place.
Precisely: The item key is sealed to the recipient with X25519. The first time you share with someone, your device signs over the key they published (Ed25519) and remembers it, so a key substituted afterwards is refused rather than used silently. Comparing their fingerprint with them out of band is offered and optional — it is the only step that proves the first key was really theirs.
Things that open later
An item set to open on a date is not held back by a promise. It is encrypted so that it cannot be opened before that day arrives, by us or by anyone — the key is mathematically tied to a public timing service that publishes a value at a set time, and until it does, there is nothing to decrypt with. We also do not hand the item over until the day, so you can change your mind up to that point.
Precisely: Timelock encryption against the drand public randomness beacon. Release after death is recorded on the item but is not automated yet; nothing is handed over on that condition until it is built, and the product says so where you choose it.
Files
A file is encrypted on your device and uploaded straight to storage without passing through our application. Its name and type travel inside the encrypted item, not on the stored object — “a 40MB video” is itself a disclosure. Each file carries its own key, so editing an item’s notes never re-uploads or re-encrypts what is attached to it.
What happens if
- Our servers are breached
- The attacker gets ciphertext, email addresses and timestamps. Items, titles, notes and files stay sealed, because the keys were never there to take.
- You lose your Secret Key
- Your binder cannot be opened, by you or by us. This is the deliberate cost of the guarantee above. Enrolled devices keep working, so losing it is not immediate — but replace it before you lose the last device that has it.
- We are compelled to hand over your data
- We can be made to produce what we hold, and what we hold is ciphertext, addresses and timestamps. We cannot be made to produce a key we have never had.
- Somebody steals your unlocked laptop
- The Secret Key is stored on enrolled devices, so the password is the remaining secret — which is why it is stretched deliberately slowly, and why the binder locks itself whenever the page reloads.
- Afterwyrd shuts down
- Ciphertext without keys is meaningless, so nothing readable is left behind. Your recipients would lose access along with you, and an export you can keep is work we owe you.
The primitives, for anyone checking
| Purpose | What we use |
|---|---|
| Password → key | Argon2id (libsodium crypto_pwhash) |
| Combining password and Secret Key | Keyed BLAKE2b |
| Login without sending the password | OPAQUE |
| Items, notes and files at rest | XChaCha20-Poly1305 |
| Sharing a key with a person | X25519 sealed box |
| Signing over a recipient’s key | Ed25519 |
| Opening on a future date | drand timelock |
| Second factor for irreversible actions | WebAuthn passkeys |
| Unlocking with a passkey, if you turn it on | WebAuthn PRF |
| In transit | TLS 1.3 |
These pages load no third-party scripts or fonts — everything that runs here is served by us, so no outside party can put code on the page that holds your keys.
We do measure how the product is used, with a third-party analytics provider. It is limited to a fixed list of actions — a page opened, the sign-up or login form opened, a binder unlocked, an item added, edited, deleted or shared — and the numbers around them, such as how many people something was shared with. It never carries what you wrote: no titles, no notes, no file names, and no names or addresses of the people you add. There is no session recording, and no automatic capture of clicks, forms or page addresses.
We also keep three running totals against your account: how many items your binder holds, how many of them are shared with someone, and how many people you have named. Three numbers, and nothing about what any of them contain.
All of this is recorded against your account number — a random string that means nothing outside our own database, and that can only be connected to you by us. Your email address is never sent. Signing out issues a new anonymous identifier for the browser, so a shared computer does not join two people together.
Found something here that looks wrong? Please let us know!