SealNotes

SealNotes implements an end-to-end encryption model to ensure privacy:

• Client-Side Encryption: All text data is encrypted using AES-256 on the client side before storage. The server only ever sees and stores encrypted data.
• Secure Hashing: Notepad names are securely hashed before being saved to the database to prevent identification.
• Zero-Knowledge Architecture: The service does not store passwords and has no access to the encryption keys. Without the user's password, the notes are undecipherable.
• Privacy: The platform does not track user activity or store metadata.

SealNotes is a web-based notepad that uses end-to-end encryption. You can use it without an account by following these steps:

1. Create a Note: Visit https://sealnotes.com/ and enter a unique name for the note's URL.
2. Set Encryption: Choose a strong password. This password is used for client-side AES-256 encryption; SealNotes does not store your password and cannot decrypt your notes without it.
3. Write and Save: Enter your text in the editor and click "Save". The text is encrypted locally before being sent to the server.
4. Accessing Notes: To retrieve a note, navigate to its unique URL and provide the correct password.

To run a local instance of SealNotes, follow these steps:

1. Clone the repository.
2. Install dependencies using pnpm.
3. Initialize your environment variables by copying the example file.
4. Start the local development environment.

Prerequisites:

• git
• pnpm

git clone https://github.com/harshsbhat/sealnotes.git
cd sealnotes
pnpm install
cp .env.example .env
pnpm local

You can deploy the SealNotes stack using the provided docker-compose.yaml. The setup includes a standard redis service and a serverless-redis-http service which acts as an HTTP bridge to Redis.

By default, the services expose the following ports:

• Redis: 6379
• Serverless Redis HTTP: 8079 (mapped to container port 80)

version: 'sealnotes'
services:
  redis:
    image: redis
    restart: always
    ports:
      - '6379:6379'

  serverless-redis-http:
    ports:
      - '8079:80'
    image: hiett/serverless-redis-http:latest
    restart: always
    environment:
      SRH_MODE: env
      SRH_TOKEN: password
      SRH_CONNECTION_STRING: 'redis://redis:6379'

The encrypt function secures a string using AES-256-CBC encryption. It derives a cryptographic key from a provided password using PBKDF2 with 100,000 iterations and a static salt.

The function returns a single string in the format iv:encryptedData, where both the Initialization Vector (IV) and the encrypted payload are hex-encoded. If the input text is empty, it defaults to a single space (" ").

import { encrypt } from "./path/to/vault";

const password = "my-secure-password";
const secretMessage = "Hello, SealNotes!";

const encryptedString = encrypt(secretMessage, password);
// Output format: "<hex-iv>:<hex-ciphertext>"

The sha256 function computes a SHA-256 hash of a given string and returns the result as a hex-encoded string. This is useful for creating unique identifiers or verifying data integrity.

import { sha256 } from "./path/to/vault";

const hash = sha256("some content");
// Returns a 64-character hex string

The decrypt function reverses the encryption performed by encrypt. It expects an encrypted string in the format iv:encryptedData (hex-encoded components separated by a colon).

Requirements:

• The encryptedText must contain exactly one colon separating the IV and the ciphertext.
• The password provided must be the same one used during encryption, as the key is derived via PBKDF2.

Errors:

• Throws if encryptedText is empty.
• Throws if the format is not iv:ciphertext.
• Throws if either the IV or the ciphertext part is missing.

import { decrypt } from "./path/to/vault";

const password = "my-secure-password";
const encryptedString = "<hex-iv>:<hex-ciphertext>";

try {
  const originalText = decrypt(encryptedString, password);
  console.log(originalText);
} catch (error) {
  console.error("Decryption failed:", error.message);
}

The serverless-redis-http service uses the following environment variables for configuration:

environment:
  SRH_MODE: env
  SRH_TOKEN: password
  SRH_CONNECTION_STRING: 'redis://redis:6379'

If you need to bypass environment variable validation (for example, during a Docker build where variables might not be available yet), you can use the SKIP_ENV_VALIDATION environment variable. Setting this to any truthy value will allow the build or development process to proceed even if the required schema is not met.

SKIP_ENV_VALIDATION=true npm run build

SealNotes requires specific environment variables for its server-side operations, particularly for Upstash Redis integration. If these are missing or invalid, the application will fail validation during build or development.

Server-side Variables

• NODE_ENV: The current environment. Must be one of development, test, or production. Defaults to development.
• UPSTASH_REDIS_REST_URL: The REST URL for the Upstash Redis instance.
• UPSTASH_REDIS_REST_TOKEN: The authentication token for the Upstash Redis instance.

Validation Behavior

• Empty Strings: Empty strings are treated as undefined. For example, setting UPSTASH_REDIS_REST_URL='' will trigger a validation error if the schema expects a string.

# Example configuration
NODE_ENV=production
UPSTASH_REDIS_REST_URL=https://your-url.upstash.io
UPSTASH_REDIS_REST_TOKEN=your-token

Defines the required props for the Client component.