Security

Everything on this page is verifiable in the code that runs in your browser.

In short

Your budget is encrypted on your device, before anything is sent.
The key is derived from your passphrase. We never receive it.
Our database holds unreadable blocks. We show you a real row on the home page.
Lose your passphrase without a recovery key and your data is gone — including for us.

The algorithms

No custom cryptography. Only the Web Crypto API built into your browser.

Key derivation: PBKDF2-HMAC-SHA256, 600 000 iterations, 16-byte salt, 256-bit output.
Encryption: AES-GCM, 256-bit key, 128-bit authentication tag.
Data key (DEK): a random 256-bit key, never derived from your passphrase. Your passphrase derives a second key (the KEK) which only wraps the DEK. Changing your passphrase therefore re-wraps one key instead of re-encrypting your whole budget.

What our server actually stores

One row per record, and none of it is readable:

an identifier, a vault identifier, a record type (transaction, category…), a timestamp;
ciphertext — the encrypted bytes;
your email address, hashed.

The record type is visible: we know that you have transactions, never what they say. This is a deliberate trade-off — it is what lets the server sync without decrypting, and we prefer to state it rather than let you assume otherwise.

“Remember this device”

Ticking that box stores your key on the device. Three limits apply, and they are enforced in code:

The key is stored non-extractable. The browser will let the page use it and never let any script read its bytes — including a script injected into the page.
It expires: 30 days absolute, or 8 hours without use. Whichever comes first. An expired key is erased, not merely refused.
It is bound to its account, and a device remembers only one. Signing in as someone else erases the previous key — on a shared computer, one person’s key can never open another’s vault.

What this does not protect against

Stated plainly, because a security page that only lists strengths is marketing.

Someone using your unlocked device. If your session is open, your budget is open. No browser-based encryption can change that.
A forgotten passphrase. There is no reset. A recovery key is offered at sign-up; without it, nobody — including us — can get your data back.
Traffic analysis. We see when you sync and how many records you have, never their contents.
An audit we have not had. Arca has not been through an external security audit. When that changes, it will be said here, with the report.

The format is open

Vault contents follow a published schema, arca.vault.v1. Your export is that format — readable by anything that implements it, not only by us — your vault is never tied to one program.