Download
Open source · local-first · end-to-end encrypted

Your notes.
Your device.
Your key.

Enclave is a private knowledge base for desktop and Android. Everything is encrypted at rest, syncs directly over your own Wi‑Fi, and works with no account, no cloud and no telemetry.

Download Enclave Take the tour

Works offline · No account · MIT licensed Press / to jump anywhere

Enclave Roadmap Q4 Encrypted

Write in blocks

Tick a task, add a line, and watch the page stay saved and encrypted. This preview runs in your browser.

Projects / Roadmap Q4
Saved · encrypted

Roadmap Q4

#product#planning
Ship the encrypted search index.
Everything stays inside the vault.

This week

  • Ship encrypted local search
  • Background sync across devices
  • Split-view polish

Next: the graph touch targets and a final pass on the editor toolbar.

Your devices, directly

Two devices on the same Wi‑Fi. Add a note on the phone and watch it reach the desktop without a server.

Same Wi‑Fi Vault key verified XChaCha20-Poly1305
Desktop
Packing list
  • Passport
  • Charger
  • Boarding pass
same vault key
Phone
Packing list
  • Passport
  • Charger
  • Boarding pass
same vault key

Peers found on this network. Both hold the same vault key.

Think in space

Drag the sticky note, or add another. The canvas is a block inside the same encrypted vault.

Drag · double-click to add · Delete removes
Product launch
Validate the sync flow with two real devices drag me

See the connections

Hover or tap a page to follow its links. The graph is generated from the page links you already have.

An assistant you host

Choose an endpoint you trust. This preview uses sample answers; the app calls only the endpoint you configure.

127.0.0.1:11434 Local endpoint Context · Roadmap Q4 3 open tasks Opt-in
Summarise this page
Roadmap Q4 is about shipping encrypted local search, background sync and the split-view polish. Three tasks are still open.
Cited

Sample answers in this preview. In the app, answers come only from the endpoint you configure.

Try
Live preview — try it, or take the controls.
01 / 05 · Editor 1–5 keys

  • 0

    cloud servers. Your notes never need one.

  • 1

    encrypted vault for pages, blocks, search and embeddings.

  • 12

    words recover your vault without a password.

  • 100%

    offline by default. Sync and AI are opt-in.

Features

Private by default. Useful by design.

Encryption is not a setting you turn on. It is the shape of the app — from the database file to the frames travelling across your Wi‑Fi.

Local-first

Works with the Wi‑Fi off

Create, edit and search without a network. Sync is an enhancement, never a requirement — no login, no subscription, no outage that can lock you out of your own notes.

At rest

The vault is ciphertext on disk

The entire vault is one SQLCipher database. Argon2id derives the key from your password or 12-word phrase; it never leaves the device.

Sync

A direct line between your devices

mDNS on your network, mutually authenticated, sealed with XChaCha20-Poly1305. No relay, no cloud routing, no middleman.

Write

Blocks, not a text box

Tasks, callouts, tables, typed databases, backlinks, split view and Markdown source — all inside the same encrypted document model.

Think

Room to think sideways

An infinite whiteboard with sticky notes, shapes, connectors, frames and mind maps — plus a graph of how every page connects.

Local AI

AI on your terms

The assistant is opt-in and talks only to the endpoint you configure: Ollama, llama.cpp, LM Studio, vLLM — or an API you choose. Embeddings can run fully offline inside the app.

Android · Beta

The same vault, in your pocket.

Four note layouts, a create stack on the FAB, folders in the drawer and the full block editor. The same encrypted core, on a phone.

Get the Android beta Known gaps

arm64 · signed APK · beta

Screenshots from the current Android build.

Android home screen with notes in a two-column Cards layout. Home Android bottom sheet for choosing a note layout. Layouts Android create stack with options for text, checklist, journal and meeting notes. Create Android block editor showing a product roadmap note with a cover and tags. Editor

Security model

There is no server to breach.

There is no backend to trust, no account to leak and no relay that sees your notes. The only copy of your key is the one derived on your device.

Read the security model

The vault on disk

Every page, block, search index and embedding lives inside one encrypted SQLCipher database. Keys are stretched with Argon2id before anything is opened.

  • SQLCipher AES-256-CBC + HMAC-SHA512
  • Argon2id 64 MiB, 3 passes, 4 lanes
  • BIP39 12-word recovery phrase

On the wire

Peers find each other only on the local network. A challenge-response handshake proves both sides hold the same vault-derived key; then every frame is sealed.

  • mDNS local discovery, no directory
  • WebSocket device-to-device transport
  • XChaCha20-Poly1305 authenticated frames

Updates you approve

Enclave never checks for updates unless you turn it on. Each update is shown with its changelog and must be downloaded and verified before the installer can run.

  • Opt-in no background update checks
  • SHA-256 artifact digest
  • Ed25519 pinned release key

Nothing phones home

No account, no analytics, no crash reporting and no license check. The optional assistant contacts only the endpoint you configure — or nothing at all.

  • No account no identity server
  • No telemetry no analytics SDK
  • No relay data stays on your network

Roadmap

The next Enclave is being built in the open.

No dates dressed up as deadlines. Each phase ends when its exit criteria are met, and the stable release stays supported while the native apps land.

  • One Rust core
  • Versioned contract
  • Native Android slice
  • Encrypted backup & restore
Read the plan Follow the status

In progress

Android, release-ready.

The Compose app runs on the same Rust core as the desktop app. The remaining work is confidence, not a rewrite.

  • Real-device pass: widgets, background sync, share target, backup and restore.
  • Cross-editor parity with the web editor, including tables, tasks and marks.
  • Instrumented tests for the vault flow and the widget cache.
  • The last settings gaps and the polish pass on the primary screens.

Exit criteria

A published parity checklist, background sync measured on a real phone, and a TalkBack pass on the primary flows.

Decision gate

A native desktop, with no browser engine.

Once the desktop stack gate closes, the native shell follows on the same core — with the platform integration a webview cannot give.

  • Vault flow, sidebar, editor, whiteboard, databases, graph and split view.
  • Command palette, settings, tray and wallpaper widgets.
  • Native menus, file dialogs, drag-and-drop and notifications.
  • Signed installers and verified updates on Linux, Windows and macOS.

Exit criteria

Feature parity with the desktop Tauri app, a screen-reader and keyboard-only pass, and signed updates verified on all three OSes.

Criteria-gated

Two native apps, one vault.

Parity is proven by interop tests, not manual demos. The native apps ship alongside the Tauri app until every surface matches, then the webview shell is retired.

  • The cross-app interop matrix in CI: Tauri ↔ native Android ↔ native desktop.
  • Release pipelines for both native apps: signing, versioning, changelog.
  • Vault migrations tested against every released fixture.
  • Retire Tauri only when the parity checklist is green.

Exit criteria

A v1.13 vault opens in both native apps, syncs with an unmodified Tauri app, and the Tauri app can be removed without losing features or data.

Deliberately not planned

iOS is not in this plan, though the versioned contract is designed not to preclude it. There is no cloud relay, account or telemetry, no shared UI framework between the apps, and no rewrite of the vault, crypto or sync protocol.

Criteria-driven, never calendar-driven. A phase ends when its exit criteria are met. Read the full plan

Questions

Answers, before you trust us with your notes.

The short version: no server, no account, no telemetry. If something here is still unclear, the full documentation is in the repository.

Does Enclave need an internet connection?

No. Creating, editing and searching work entirely offline. Sync uses your local Wi‑Fi. The optional assistant can use a local endpoint that never touches the internet, and update checks are strictly opt-in.

Where are my notes stored?

In one encrypted SQLCipher vault on your device. Backups are still-encrypted snapshots, and there is no server that holds a copy. The desktop app can export Markdown and HTML when you want a portable copy.

What happens if I forget my password?

Use the 12-word BIP39 recovery phrase you saved when the vault was created. If both the password and the phrase are lost, the vault cannot be decrypted — there is no recovery server, by design.

Can I sync more than two devices?

Yes. Devices on the same network discover each other over mDNS and authenticate with the vault-derived sync key. If your network blocks mDNS, add a peer manually by address from the sidebar.

Is Enclave really open source?

Yes, MIT licensed. The code, decision records and security model are in the repository, and you can build from source. The website itself is a static page with no analytics.

Why is Android still beta?

The native Android app is part of the move away from the old webview shell. It builds, signs and runs the same encrypted core, but real-device sync, widgets and a TalkBack pass are still tracked as open work.

What does the AI assistant send?

Only the prompt and page context you ask it to use, and only to the endpoint you configure. With a local endpoint such as Ollama, nothing leaves your machine; Enclave has no cloud AI service. The homepage demo uses sample answers and sends nothing.

Does sync work over the internet?

No. There is no Enclave relay: devices discover each other on the same local network and sync directly. If mDNS is blocked, add a peer by address. Remote sync is not part of the current plan.

Download

Start with a blank page.

One vault, every device you own. Download the latest stable release, then let your devices find each other on your Wi‑Fi — no server in between.

Download Enclave
  • Linux

    Linux

    x86_64 · .deb or .AppImage

    StableDownload
  • Windows

    Windows

    x86_64 · .msi or .exe

    StableDownload
  • macOS

    macOS

    Apple Silicon · .dmg

    StableDownload
  • Android

    Android

    arm64 · signed .apk

    BetaDownload

Every release ships with checksums. Updates are opt-in and verified against a pinned Ed25519 release signature before the installer is allowed to run.

All releases and checksums Build from source

Building the next Enclave. The latest stable release above is the supported product while the dedicated native apps are built. Read the plan

Installing and verifying

Linux

Make the .AppImage executable and run it, or install the .deb with your package manager. The build is x86_64.

Windows

Run the .exe installer or the .msi. If SmartScreen appears, verify the checksum before choosing to run it.

macOS

Open the .dmg and drag Enclave into Applications. If Gatekeeper blocks the first launch, use Open from the context menu. Apple Silicon.

Android

Download the signed .apk on the phone, allow installs from that app when Android asks, then open the file. arm64; no Play Store.

Download SHA256SUMS from the release to verify a manual install: sha256sum -c SHA256SUMS on Linux, or shasum -a 256 -c SHA256SUMS on macOS. Updates are separately checked against the pinned Ed25519 signature before installation.

Documentation

Built in the open.

Enclave is MIT licensed. Read how it works, how it is tested, and why it is built this way — including the decisions that were reversed.

Getting startedFeatures, architecture, prerequisites and commands. Security modelTrust boundaries, cryptography and reporting. ChangelogEvery release in detail, with fixes and limitations. Decision recordsWhat was chosen, what was rejected, what was wrong. ContributingBuild, test, review and commit conventions. Native-apps planWhere the rebuild is going, and why.
Esc

Command palette

↑↓ navigate ↵ open Esc close