Encryption at a glance
Every piece of data in your pod is encrypted using AES-256-GCM — the same standard used by banks and governments. The keys that open it never leave your device.
How it works
When you create a pod, a random 256-bit family key is generated
A wrapping key is made from a secret only your family holds — the recovery kit code created with your family, an optional family passphrase, or (for members of older families) a password run through PBKDF2 (hundreds of thousands of rounds, SHA-256, recorded with the data so it can be raised again without anyone doing anything) with a random 16-byte salt
The family key is wrapped (encrypted) with your wrapping key using AES-KW
All your family data (Automerge binary) is encrypted with the family key using AES-GCM with a random 12-byte IV
The encrypted payload, wrapped keys, and salts are stored in the .beanpod file
Key details
- Algorithm: AES-256-GCM (encryption) + AES-KW (key wrapping)
- Key derivation: PBKDF2 with hundreds of thousands of iterations, SHA-256, 16-byte random salt (for passphrase and password wraps); the iteration count is recorded with the data so it can be raised again without anyone doing anything
- IV: 12 bytes, randomly generated for each save
- Implementation: Web Crypto API (native browser cryptography)
If you set an optional family passphrase, the app suggests six words drawn from a large public list, and a phrase you type yourself is strength-checked as you type. An older, shorter suggestion is gently flagged in Settings so you can swap it when you have a minute. A strong passphrase makes guessing very expensive, but no passphrase is a promise of anything: keep it private, and keep your recovery kit too.
All encryption happens in your browser using the native Web Crypto API. No keys, PINs, passwords, recovery codes, or unencrypted data are ever transmitted to any server.