---
title: "How Encrypted Journaling Actually Works"
description: "Passphrases, key derivation, and why \"we can't read your journal\" can be a mathematical statement instead of a promise. A plain-language walkthrough."
canonical: "https://sealedjournal.com/j/how-encrypted-journaling-works"
updatedAt: "2026-08-11"
category: "Answers"
---

# How encrypted journaling actually works.

_A short list of things you have to trust._

When you choose a passphrase in The Sealed Journal, it is never stored anywhere. Instead it is run through a key-derivation function — PBKDF2 at 600,000 iterations, the count OWASP currently recommends — which deliberately burns computation to turn your passphrase into an encryption key, and to make guessing passphrases expensive for an attacker. That derived key encrypts your entries with AES-256-GCM, the standard that protects most of the world's sensitive traffic.

All of this happens in your browser, on your machine. What gets written to storage is ciphertext: without the key, it is statistically indistinguishable from random noise. When you return and type your passphrase, the same derivation runs, the same key emerges, and the entries unseal. Wrong passphrase, wrong key, nothing readable — there is no "forgot password" flow because there is no one on the other end who knows more than you do.

The consequence worth sitting with: the security of your journal reduces to the strength of your passphrase and the physical security of your devices. That's a short list. It's meant to be. Every party you don't have to trust is a party that cannot fail you.

## Questions

### What encryption does The Sealed Journal use?

AES-256-GCM, with a key derived from your passphrase via PBKDF2 at 600,000 iterations — the OWASP-recommended count — performed locally in your browser.

### Is browser cryptography trustworthy?

The journal uses the Web Crypto API — cryptography implemented natively by the browser itself, the same machinery that secures HTTPS, not a script's homemade math.

### Can a strong passphrase really not be brute-forced?

Key derivation makes each guess costly, so strength scales steeply with length. A few random words is a far better passphrase than a clever short one.

## Price

The Sealed Journal is a one-time purchase of $24 (introductory price, rising to $29). No subscription, no account, lifetime updates, 30-day refund. Buy at https://sealedjournal.com/#pricing

## Elsewhere

- Hub: Answers — https://sealedjournal.com/journals/answers
- All journals — https://sealedjournal.com/journals
- HTML version of this page — https://sealedjournal.com/j/how-encrypted-journaling-works