SharpMD

ENES

Security: what is encrypted, what is not, and how to leave

Your notes are plain Markdown files. In the cloud they are encrypted at rest, and a folder with a password is encrypted in your browser so the server cannot read it. This page says which is which, and where each one stops.

The details are in Privacy and in the server README, and the code is open on GitHub.

Two layers, and they are different

Encryption at rest, for the whole cloud

• The server stores the text of your notes, of their previous versions and of the comments you leave for the AI encrypted with AES-256-GCM.
• That protects the database and its backups: a copy of the file is unreadable without the key.
• It is not end-to-end encryption. The running server holds the key, because it has to read a note to share it and to serve your AI over MCP.
• Sign-in codes, sessions and AI tokens are stored as hashes.

Folders with a password, encrypted in your browser

• Everything inside a protected folder is encrypted in your browser before it is uploaded. The server stores text it cannot read.
• Each folder has a random 256-bit key. Your password does not encrypt the notes: it wraps that key, with PBKDF2-SHA-256 and 600,000 rounds. Notes are encrypted with AES-256-GCM.
• The password and the key do not leave your browser.
• You can also protect your whole cloud with one password, from Settings, under Cloud.
• Without the password and without the backup key the notes cannot be recovered. SharpMD cannot recover them either.

What stays visible even when a folder is protected

• The names of its notes and folders, their size and when they changed.
• Those notes cannot be shared, have no public links, take no comments for the AI and are left out of the server search.
• If you unlock a folder for your AI, your browser sends its key to the server, which keeps it in memory only, for the time you chose. Locking the folder, the time running out or a server restart erases it. It is never written to disk.
• Pages of a published site are public, so they are stored without encryption at rest.

Where images are kept

• In a folder on your disk, the image is saved next to the document. In a note kept in the browser it stays inside the note. Neither leaves your device.
• In a cloud note the image is uploaded to sync.sharpmd.app as an attachment. The server stores the file, its type, its size, a hash and the date, and not the name the file had.
• Before saving, SharpMD makes the image smaller in your browser and removes its camera, date and location. With the quality set to Original, the metadata stays.
• The address of a cloud image works like a public link: anyone who has it can see the image. It is long and random and nothing lists it, but sharing the note hands it to whoever reads the note.
• Images in a protected folder are encrypted in your browser with the key of the folder, and they have no public address.
• An image that no note uses is deleted after 30 days. Deleting your account deletes all of them.

Recovering what you lost

• A deleted cloud note goes to the trash for 30 days and can be restored. A note from a protected folder stays encrypted there.
• On the paid plan the previous versions of a note are kept for 30 days.
• The backup key that the app offers when you protect a folder is the key of that folder: with it you can set a new password.
• A copy of each cloud note you open is kept in your browser, so it opens without a connection.

If SharpMD closes

• A note is a .md file. What you write in a folder on your disk is already yours, with nothing to export.
• The Markdown stays Markdown: any editor opens it. A right-click on a folder in the explorer offers Export the folder, which puts all its notes into one PDF, HTML, Word or Markdown file.
• Settings > Cloud > Download all my notes builds a ZIP of everything you have in the cloud in your browser, with the same folders and the images included. Protected folders are decrypted on your device before they go in.
• The app is MIT and the sync server is AGPL, and the server is one file that you can host yourself. In Settings, Account, you can point the app at your own server, or turn the cloud off.
• You can delete your account yourself in the app, and the server deletes your notes, history, trash, tokens, shares and sites.

Report a vulnerability

Write to hello@sharpmd.app with what you found and the steps to repeat it. Please do not publish it until we have had the chance to fix it. The code is on GitHub for anyone who wants to read it.

Open the app

Everything else is on the SharpMD home page.

HomePrivacyWhat's newTermsSupport