Encryption
ZetoPad offers optional database encryption using SQLCipher for sensitive data.
How It Works
When encryption is enabled:
- Your entire database is encrypted with AES-256
- A password is required to unlock on startup
- Data is decrypted only in memory while using the app
- The file on disk remains encrypted
Enabling Encryption
- Open Settings > Security
- Click “Enable Encryption”
- Enter a strong password
- Confirm the password
- Click “Encrypt Database”
Lock Screen
When encryption is enabled, ZetoPad shows a lock screen:
- On app launch
- After a configurable idle timeout
- When you manually lock (
Cmd+L)
Enter your password to unlock.
Changing Password
- Open Settings > Security
- Click “Change Password”
- Enter your current password
- Enter your new password twice
- Click “Change”
Removing Encryption
To disable encryption and store data unencrypted:
- Open Settings > Security
- Click “Remove Encryption”
- Enter your current password
- Confirm the action
Your data will be decrypted and stored in plain SQLite format.
Technical Details
Encryption Standard
- Algorithm: AES-256-CBC
- Key Derivation: PBKDF2 with SHA-512
- Library: SQLCipher
Performance
Encryption adds minimal overhead:
| Operation | Overhead |
|---|---|
| Read | ~5% |
| Write | ~10% |
| Search | ~5% |
File Size
Encrypted databases are the same size as unencrypted ones.
Security Best Practices
Strong Passwords
Use a password that is:
- At least 12 characters
- Mix of letters, numbers, symbols
- Not used elsewhere
Idle Lock
Configure auto-lock in Settings > Security:
| Setting | Recommended |
|---|---|
| Lock after idle | 5 minutes |
| Lock on sleep | Enabled |
Backup
Always keep encrypted backups of your data. See Backup & Restore.
What’s NOT Encrypted
- Application settings (
settings.json) - Keybindings (
keymap.json) - Theme preferences
These files don’t contain your snippet content and are stored in plain text.
Offline Security
Since ZetoPad is completely offline:
- No data transmitted over network
- No cloud backup (unless you set it up)
- No remote access possible
- Physical device security is your responsibility