How to Verify End-to-End Encryption Yourself

MyLifePapers encrypts your household records with a key created on your device. We never receive a copy we can use. You don’t have to take that on faith. This page describes four tests that let you verify it yourself. Most take a few minutes. One requires nothing more than turning off your wifi.

A note on terms before you start. Encryption alone doesn’t determine who can read your data. What matters is who holds the key. Many services encrypt data while retaining the ability to read it, because the key stays with the company. Phrases like “bank-grade encryption” and “military-grade encryption” describe the strength of the lock, not who holds the key. “End-to-end encrypted” and “zero knowledge” are claims about the key itself. Those are the claims the tests below verify.

Every test works in the free trial, which holds up to 10 records with no account, no email, and no credit card, and uses the same encryption as the full product.

Test 1: Confirm your data is encrypted on disk

Create a note containing a word you’ll recognize, such as purplewalrus8842. Then locate the file where the app stores your records:

• Mac: ~/Library/Application Support/mylifepapers/mlp-vault-v3.db
• Windows: %APPDATA%\mylifepapers\mlp-vault-v3.db

Search the file for your word. On a Mac, in Terminal:

strings ~/Library/Application\ Support/mylifepapers/mlp-vault-v3.db | grep -i purplewalrus8842

On Windows, in PowerShell:

Select-String -Path "$env:APPDATA\mylifepapers\mlp-vault-v3.db" -Pattern "purplewalrus8842"

The search returns nothing. Your note is in that file, but not as readable text. The file’s header is encrypted as well. A standard database file begins with the text SQLite format 3. This one doesn’t, and database tools cannot open it.

Test 2: Confirm the key is created on your device

Turn off your wifi. Disconnect ethernet as well. Restart your computer so nothing remains in memory, then unlock the app while still offline. It opens. A cold unlock with no network connection uses exactly two inputs: your password and the file from Test 1. The key is derived on your device each time you open the vault.

The app has no online requirement after activation. A device that never connects to the internet again will continue to work indefinitely: reading, adding, editing, and searching records.

To be precise about what this test proves: it shows a key exists on your device. It cannot show that the key exists only on your device, because apps that keep a readable copy on their own servers can also cache data locally and work offline. This test establishes one link: unlocking your vault requires no server. What leaves your device is a separate question, and it’s Test 4.

The off-grid version

MyLifePapers can sync with no internet connection at all. Activation requires a brief connection at purchase. After that, point your computers at a shared folder you control: a USB drive or a folder on your home network. The devices keep each other current by exchanging encrypted files through that folder.

Local-folder sync makes no network calls, requires no login, and reads your license from a local cache that never expires for a one-time purchase. The only step that requires the internet is the purchase itself.

Test 3: Confirm we cannot unlock it without you

Ask us to reset your password. We can’t. There is no administrative tool that unlocks your vault. If you lose both your password and your recovery code, your data is unrecoverable, by you or by us. Our terms state this plainly.

The inability is the point. A company that can restore your access is a company that holds your key. We cannot restore yours, because we never had it.

Test 4: Confirm what leaves your device

End-to-end encryption is a claim about what reaches our servers. The most direct way to check it is to sync through a cloud account you already own.

Point the app at your own Google Drive or Dropbox and sync once. Open the folder in your browser and open any file ending in .enc. It contains only ciphertext. That file is exactly what left your computer, stored in your own account, unreadable even to you.

To verify further, monitor the app’s network activity while syncing through your own Drive. Use an outbound firewall such as Little Snitch or LuLu on a Mac, or your router’s logs. The app connects only to your cloud provider. It makes no connection to our servers. A key cannot reach servers the app never contacts. An app that kept a readable copy on its own servers would have to connect to them, and you would see every connection.

If you sync through MyLifePapers Cloud instead, you cannot inspect our storage directly. The file stored there is the same encrypted file, but you would be trusting the design rather than checking it. If you prefer the version you can verify yourself, use your own cloud.

An encrypted copy of your key is stored with your data

For your phone, your laptop, and your household members’ devices to open the same vault, a copy of the key must reach each device. An encrypted copy of your key travels with your data to whichever cloud you sync through. If that’s your own Drive, it’s stored in your account and never reaches us. If it’s MyLifePapers Cloud, it’s stored on our servers.

That copy is protected by a key derived from your password. Your password never leaves your device (Test 2), and we cannot decrypt the copy (Test 3). To anyone who holds it, including us, it’s ciphertext.

One piece of metadata isn’t encrypted

Syncing requires a small amount of readable metadata, and one item of it is personal: your display name. It’s stored unencrypted so your devices and household members can be told apart during sync.

This is why we never ask for your legal name or full name. The display name is whatever you choose to enter. Enter “K” and it reads “K”. The email you used at purchase is never stored in your vault. No records, no passwords, and no documents are readable.

What you can’t verify yourself

The tests above show the app behaving as end-to-end encryption requires, which a counterfeit would fail. They can’t rule out a mistake or backdoor in code you can’t read, because MyLifePapers isn’t open source.

Here is what covers that gap:

• The encryption itself is performed by SQLCipher, libsodium, and Argon2id, public tools that are independently reviewed. Argon2 was selected as a standard through open competition. Our work is integrating them correctly, and the tests above check that integration.
• The design is documented, so a qualified reviewer can evaluate it without source access.
• Security issues can be reported to [email protected].
• An independent audit is planned. It hasn’t happened yet. This page will link to the report when it has.

The short version

Search your vault file for a word you typed: it isn’t there. Unlock the app after a cold start with no internet: it opens. Ask us to reset your password: we can’t. Open the file in your own cloud: ciphertext. What remains rests on independently reviewed encryption libraries, a documented design, an open channel for reports, and an audit to come.

Every test on this page works in the free trial: up to 10 records, no account, no email, no credit card. Try it free before you spend anything.