Sync and encryption

Sync between your Macs

Sign in with the same account on each Mac and your history follows you. A copy on one Mac shows up on the others within about a minute. Deletes sync too, so a card you delete on one Mac disappears from the rest.

Every Mac keeps a card for every item, so you can see and search your whole history even offline. Big things like older images and long text download when you need them. See History and storage.

Secrets Pasta detects never sync. They stay on the Mac where you copied them. See Privacy and secrets.

How your history is encrypted

• Your account has its own random 256-bit key. Each item is encrypted with it on your Mac (AES-256-GCM) before it’s uploaded.
• Our server creates the key the first time you sync and stores it only wrapped by Google Cloud Key Management Service (KMS). The master key never leaves KMS, and the wrapped key only unlocks for your account.
• After you sign in, your Mac fetches the key and keeps it in memory only. It isn’t saved to disk or to the Keychain (since version 0.3.9).
• Our database (Google Firebase) and file storage (Google Cloud Storage) hold only encrypted data. Someone who got a copy of them would see nothing readable.

What “not end-to-end” means

This is encryption at rest, not end-to-end encryption. Our server can unlock your key while it works for you, for example to label a new copy or rank search results. It doesn’t store or log your copies in readable form.

The upside: there’s no passphrase to remember or lose. Signing in is all it takes to get your history on a new Mac.

Delete Synced Data

Settings → Account → Delete Synced Data deletes every synced item from our server, and your key with it. History on this Mac stays. Anything you copy afterwards syncs again with a brand new key.

To delete your history everywhere instead, use Clear History (see History and storage). To delete your account, see the Privacy policy.