← All journal posts

Crypto explained

What does encryption before sync actually mean?

“We encrypt” can mean a dozen things. The question that matters is when the lock clicks. If it clicks on your device before upload, the service can move boxes without reading the contents. If it clicks only after data arrives, you are trusting the road and the warehouse more than you may realize.

A suitcase, not a postcard

A postcard is readable by every sorter. A locked suitcase can travel without showing the clothes. Encryption before sync is the suitcase. The airline can lose a bag without wearing your shirts. They also cannot open it for you if you lose the key. That second sentence is the part people skip.

Stax Pass is designed to apply XChaCha20-Poly1305 on the device, then sync the sealed record. That is a privacy design with a recovery cost: you hold the password and the phrase.

Questions worth asking any app

What is encrypted? Passwords only, or notes too?

Where does encryption happen? Device or server?

Who can decrypt? You, the company, or both?

What happens if I forget everything? Is there a spare key?

If a company hates those questions, believe that.

What sync is for

You want a new phone to have your logins. Sync is how sealed records arrive. Encryption before sync means the new phone unlocks them locally after you prove who you are—not that a support agent prints you a list.

Prepare before you travel or upgrade. Confirm you can unlock. Confirm the recovery phrase is not only on the old phone. See a new-phone plan.

Is this worth paying for?

Free sync is everywhere. Sealed sync is the product. A dollar a month is small next to an open list in iCloud Notes that also holds your banking password. Start the trial and save email first so you can feel the difference when you switch devices.

Take this with you

  • Ask when encryption happens, not only whether it exists.
  • Stax Pass is designed to lock on the device, then sync.
  • No spare company key means you must keep recovery offline.

Common questions

If it syncs, is it in the cloud?

A sealed copy can be stored so devices stay in sync. “In the cloud” is not the same as “readable in the cloud.”

Can support decrypt for me?

No. That is the honest limit. Use the recovery phrase if you lose the password.

Is this end-to-end encryption?

It is the same family of idea: readable at user-controlled ends, sealed in the middle. Ask for the mechanism. See end-to-end in plain language.