What is Client-Side Encryption in Notes?

Client-side encryption (often coupled with zero-knowledge architecture) is a cryptographic design pattern where information is encrypted and decrypted exclusively on the user’s local endpoint device.

When software enforces client-side encryption, plaintext data is transformed into ciphertext using cryptographic algorithms (such as AES-GCM-256 or ChaCha20-Poly1305) before the data is written to disk or transferred over a network. The encryption keys remain strictly in the possession of the user and are never disclosed to the application vendor, cloud storage host, or network transit providers.

The critical difference between encryption models

Many commercial cloud note apps claim they feature “bank-grade encryption.” However, there is a fundamental distinction between storage encryption models:

Encryption Dimension	Server-Side Encryption (Cloud SaaS)	Client-Side Encryption / Local-First
Key Custody	Cloud vendor controls encryption keys	User exclusively holds encryption keys
Vendor Decryption Ability	Vendor employees can inspect data	Mathematically impossible for vendor to read
Subpoena Vulnerability	Vendor can be compelled to hand over plaintext	Vendor has zero readable data to produce
Cloud Breach Risk	Database dump exposes all customer notes	Ciphertext is unreadable without user key

Cryptographic key derivation

In true client-side encrypted systems, the master key is derived from a user passphrase using memory-hard key derivation functions like Argon2id or PBKDF2:

[User Master Passphrase] + [Random Salt]
                   ↓
        [Argon2id KDF (Time + RAM)]
                   ↓
    [256-Bit Master Cryptographic Key]
                   ↓
     [AES-256-GCM / XTS-AES-128]
                   ↓
           [Encrypted Note]

This guarantees that brute-force dictionary attacks against stolen ciphertext are computationally infeasible.

Client-side encryption vs Operating system encryption

Some note applications implement complex custom encrypted databases on disk. However, this creates severe trade-offs: custom encrypted blobs cannot be indexed by Spotlight, cannot be searched with grep, and cannot be opened if the application develops bugs.

How Oyma protects your files

Oyma takes a cleaner, battle-tested architectural approach on macOS:

• Notes are stored in transparent, open UTF-8 Markdown format on your local drive.
• Encryption at rest is delegated to macOS FileVault, Apple’s hardware-accelerated, Secure Enclave-backed whole-disk encryption.
• Because Oyma initiates zero cloud network egress, your files are never exposed to remote internet vectors in the first place.

You get the full security of cryptographic hardware protection alongside the universal interoperability of open plain text.