TextSandbox uses XChaCha20-Poly1305 authenticated encryption and Argon2id to protect the Master Password. Vault content is encrypted locally before it is saved or synced. This page describes how the encryption works — and what encryption cannot protect.
Algorithms used
One algorithm to encrypt content, one to protect the Master Password. Both run locally on your device.
Content encryption
Authenticated encryption (AEAD): the XChaCha20 stream cipher keeps content confidential, while the Poly1305 authentication tag detects any modification of the encrypted data. A 192-bit extended nonce makes random nonce generation safe.
Master Password protection
A memory-hard key derivation function and winner of the Password Hashing Competition. Argon2id turns your Master Password into an encryption key and makes brute-force password guessing expensive.
All encryption and decryption happens locally on your device. Cloud Sync stores encrypted data only and never receives the Master Password, Recovery Key or readable content.
Encryption pipeline
Text only exists in readable form in memory while the Vault is unlocked. Before it touches the disk or leaves the device, it is always encrypted.
In memory (Vault unlocked)
# Research notes
Client contract — draft 3On disk & in the cloud
a7f3e1b9c05d... 4c2d8e
+ Poly1305 auth tagFour encryption steps
The password lives in memory only for as long as the Vault stays unlocked.
The Master Password becomes an encryption key via a memory-hard KDF.
Content, titles, history and attachments are encrypted together with an authentication tag.
Only encrypted data reaches the disk — and only that data is ever synced.
Vault content, document titles, edit history, attachments and workspace state are encrypted with XChaCha20-Poly1305 before being written to disk — they never exist there as plain text.
The Master Password is protected with Argon2id, is never stored and is never sent to the cloud. A cloud account does not replace it and cannot decrypt your Vault.
Cloud Sync stores encrypted data only and never receives the Master Password, Recovery Key or readable content. The service has no key to decrypt your Vault.
No backup key exists anywhere else. If both the Master Password and Recovery Key are lost, the encrypted data cannot be decrypted — the direct consequence of real encryption.
Because encryption happens at the data layer, TextSandbox suits notes, drafts, personal documents or work data you would rather not keep as plain text on your machine or in the cloud.
Recovery Key & auto-lock
When you create a Vault, TextSandbox issues a Recovery Key — the only second path to the Vault's decryption key if you forget the Master Password. It should be stored offline, separate from the Vault, and is never sent to the cloud.
The app can also lock itself after a period of inactivity. When you close the window, TextSandbox saves your edits and workspace state, confirms the Vault is safely locked, and only then exits.
Never store the Recovery Key inside the very Vault it is meant to recover.
Vault states
Content sits on disk in encrypted form. It cannot be decrypted without the Master Password or Recovery Key.
Content is decrypted in memory so you can work. Autosave re-encrypts every change before writing it back into the Vault.
After the idle period you configured, the Vault returns to the locked state and the decryption key is discarded from memory.
Save edits, save workspace state, confirm the Vault is safely locked, then quit.
Threat model
Encryption protects data while the Vault is locked, while it sits on disk, and when the .tsbx file is copied off the device. While the Vault is unlocked, content must be decrypted in memory so you can work — so some risks are things encryption simply cannot address.
The SECURITY, PRIVACY and THREAT MODEL documents shipped with the product describe the scope in detail. For the latest versions, see textsandbox.com or contact cuongtechnology@gmail.com.
Where does data live?
| Item | On device | In the cloud |
|---|---|---|
| Document content | Encrypted | Only with Sync on — encrypted |
| Document titles | Encrypted | Only with Sync on — encrypted |
| Attachments | Encrypted | Only with Sync on — encrypted |
| Version history | Encrypted | Only with Sync on — encrypted |
| Workspace state | Encrypted | Only with Sync on — encrypted |
| Readable content | In memory only while unlocked | Never |
| Master Password | Never stored (Argon2id) | Never |
| Recovery Key | Stored offline by you | Never |
Privacy
You can use TextSandbox entirely locally: no account, no internet connection, and no cloud plan — the full encryption still happens on your machine. Cloud Sync is an optional add-on, never a requirement for using the app.
Encryption is strongest when combined with the right habits.
Do not share the Master Password or Recovery Key with anyone.
Argon2id greatly slows brute-force guessing, but the strength of your password is still the deciding factor.
Never store the Recovery Key inside the Vault it is meant to recover.
Keep at least one Vault backup in a safe location.
Lock the Vault before stepping away from a shared device.
Losing both the Master Password and Recovery Key means the content cannot be recovered.
Configure an idle timeout that matches your working environment.
Reach out to the author directly — every encryption and security report is reviewed carefully.