How Sonaa Encrypts Your Data
A deep dive into our end-to-end encryption approach and what it means for your privacy.
Updated 7 October 2026. An earlier version of this article described an older design (PBKDF2, "Quick Unlock", encrypted shelf names) that never shipped. This version matches the app as it is.
End-to-end encryption means the content of your tasks is encrypted on your device before it leaves it. The server stores that content only as ciphertext and holds no unlocked key to decrypt it.
Table of Contents
How the key is derived
When you choose encryption at setup, your browser generates a random data key and derives a second key from your password with Argon2id (3 passes, 64 MiB) and a random salt. The data key is wrapped with the password key; only the wrapped form, the salt and the parameters are stored on the server, so you can unlock the data key when you sign in on another device.
password + salt → Argon2id → password key ─┐
random data key ───────────── wrapped by ──┘ → stored on the server
On your device the unlocked data key is kept in IndexedDB as a non-extractable key: the page can use it, but cannot read its bytes back out.
What is encrypted
Encrypted with AES-256-GCM before sync:
- Task titles
- Notes
- Subtasks
Not encrypted, because the server needs them to sync and order your week: dates, times and durations, reminders, colors, completion status, recurrence rules, sort order, the names of your shelves and calendar, and your account data.
What it does not protect against
Your password never reaches our server. The same Argon2id run that yields the password key also yields a separate sign-in key (via HKDF), and only that is sent when you sign in; it cannot be turned back into your password or your keys. The app's code, however, is delivered by our server. End-to-end encryption therefore protects your stored content and your password, but not against someone who takes control of our servers and changes the app – a modified app could read your password or your decrypted tasks the next time you use it.