PrivacyNotes
English
System Català Čeština Deutsch English Español Français Italiano Nederlands Polski Português (BR) Português (PT) Svenska Türkçe Русский Українська العربية ไทย 한국어 日本語 繁體中文
App

Help & FAQ/Security & privacy

Why a recovery phrase instead of a username and password?

Ask your AI agent instead

It can feel backwards at first, but a single recovery phrase is the stronger construction. With a username and password, the username is not a secret (it shows up in every breach dump), so all the security rests on the password, and human-chosen passwords average maybe 30 to 40 bits of entropy. Your 12-word phrase is a guaranteed 128 bits, generated by your device, never chosen by a human, and never reused from another site.

There is also no password for us to lose. A password login means the server stores at least a password hash, which can be leaked, cracked, or phished. Under self-custody, your phrase never leaves your device: it derives your encryption keys locally, and the server only ever sees encrypted data. There is no hash to steal and no password reset flow for an attacker to abuse.

If typing 12 words feels clunky: you can save the phrase to your password manager with one tap (Settings > Security > Phrase), and signing in feels like any other login. Prefer a familiar flow? Sign in with Google, Apple, or GitHub works too: you still get a phrase under the hood, and you choose whether it stays on your device or we store it for you.

// Read the source

THREAT_MODEL.mdKey derivation

Our source and documentation are on GitHub, in English.

Help & FAQ

Answers and step-by-step guides: security, sync, pricing, and switching from other apps.

// Related questions

What can PrivacyNotes see about my notes? Why does the App Store privacy label say my data is linked to me? Is PrivacyNotes open source? How do I turn on two-factor authentication (2FA)? Can I connect more than one login to my account?

Still stuck? Ask your AI agent.

You get an answer in seconds instead of waiting for a reply. Your assistant reads all 116 answers and every import guide at once, so it can combine them, follow up on your question, and explain it in your own words. We never see any of it, because we do not run a chatbot.

  1. Copy the prompt.
  2. Paste it into ChatGPT, Claude, Gemini, or any other AI assistant.
  3. Ask your question, in your own language.
  4. Keep that chat open. Next time, ask straight away.
Show AI prompt 
Answer my questions about PrivacyNotes using only its help center, its changelog and its security documentation.

Start here: https://privacynotes.app/llms-index.txt
It lists every question with the page that answers it. Fetch the one or two that match mine.
If you can only make one request, fetch https://privacynotes.app/llms-full.txt instead.
If you cannot fetch a .txt or .md file, read https://privacynotes.app/help, https://privacynotes.app/changelog and https://github.com/LifetimeLabsDev/PrivacyNotes.app instead.

For what changed, or where something moved, fetch https://privacynotes.app/changelog.md.

For how the encryption works, what the server can read, or how to check any of it yourself, fetch https://privacynotes.app/docs/index.md and follow it to one of the documents it lists. That index is a router: cite the document, never the index.

Rules:
- Use only those pages. If they do not answer something, say so instead of guessing.
- Never invent a feature, a menu path, a price, or a limit.
- End your reply with the "Source:" URL from the page you used, exactly as written.
- Answer in the same language as my question.
- Never ask me for my recovery phrase, my PIN, or the contents of a note.

If no question follows, ask me what I would like to know.

My first question:

Never paste your recovery phrase, your PIN, or a note into an AI.