Skip to content

Answers

How encrypted journaling actually works.

A short list of things you have to trust.

Buy Once · $24

When you choose a passphrase in The Sealed Journal, it is never stored anywhere. Instead it is run through a key-derivation function — PBKDF2 at 600,000 iterations, the count OWASP currently recommends — which deliberately burns computation to turn your passphrase into an encryption key, and to make guessing passphrases expensive for an attacker. That derived key encrypts your entries with AES-256-GCM, the standard that protects most of the world's sensitive traffic.

All of this happens in your browser, on your machine. What gets written to storage is ciphertext: without the key, it is statistically indistinguishable from random noise. When you return and type your passphrase, the same derivation runs, the same key emerges, and the entries unseal. Wrong passphrase, wrong key, nothing readable — there is no "forgot password" flow because there is no one on the other end who knows more than you do.

The consequence worth sitting with: the security of your journal reduces to the strength of your passphrase and the physical security of your devices. That's a short list. It's meant to be. Every party you don't have to trust is a party that cannot fail you.

The Typewriter Experience

The cursor stays. The text moves.

In Write mode, your cursor remains exactly at the centre of the screen. The page rises up to meet it. Past words fade into soft shadow at the edges, leaving the present sentence in clear focus. Switch to Read mode and the entry flattens into an evenly lit document — the fade is for writing; the flat light is for returning.

Radical Privacy & Encryption

AES-256-GCM, in your browser, with a key only you derive.

  • ·PBKDF2 key derivation at 600,000 iterations — the OWASP 2024 recommendation. Existing journals upgrade transparently on first unlock.
  • ·No accounts, no telemetry, no analytics, no cookies, no third-party scripts.
  • ·IndexedDB storage with a localStorage fallback. Encrypted before it touches the disk.
  • ·The file is not minified. You can read the source. We'd rather you trust it than us.

What It Does Not Do

  • ✕No word counts chasing you across the screen.
  • ✕No formatting toolbar wrestling your thoughts into neatness.
  • ✕No cloud sync. No distant servers. Your words stay yours.
  • ✕No social sharing. Your vulnerability is not content.
  • ✕No AI assistant finishing your sentences.
  • ✕No streak counters. No guilt. No gamification.
  • ✕No subscriptions. No mood trackers. No noise.

Licensing & Gift Copy

One purchase covers up to three of your personal devices. It also includes a second untouched copy of the file — meant to be given to one person you trust. Lifetime updates. 30-day, no-questions refund. If you run a clinic, school, or workplace and want a copy for everyone, ask us about a site licence.

One Purchase. Yours Forever.

$24

The price is $24 today. It will become $29.

One-time payment

Get The Sealed Journal

Questions

What encryption does The Sealed Journal use?

AES-256-GCM, with a key derived from your passphrase via PBKDF2 at 600,000 iterations — the OWASP-recommended count — performed locally in your browser.

Is browser cryptography trustworthy?

The journal uses the Web Crypto API — cryptography implemented natively by the browser itself, the same machinery that secures HTTPS, not a script's homemade math.

Can a strong passphrase really not be brute-forced?

Key derivation makes each guess costly, so strength scales steeply with length. A few random words is a far better passphrase than a clever short one.

More in Answers

See all →

You might also read

The cursor will be there when you return.

Centered. Blinking. Patient.

Start Writing
Browse all 89 entry points.