How your passphrase becomes a key
PBKDF2-SHA256 at 250,000 iterations, an AES-256-GCM key, and why none of it ever leaves your browser.
PBKDF2-SHA256, 250,000 iterations.
Your passphrase is not a key — it is a short, guessable string. Turning it into one means deliberately slowing the conversion down, so that guessing costs an attacker real time. SEES runs PBKDF2 with SHA-256 over 250,000 iterations against a per-vault salt, using the browser's own Web Crypto implementation.
AES-256-GCM, derived in your browser.
The output is a 256-bit AES-GCM key. GCM is authenticated encryption: it does not only hide the contents, it detects tampering, so modified ciphertext fails to decrypt rather than quietly returning wrong data. Every write gets a fresh random IV.
The key exists in browser memory for as long as your vault is unlocked. It is never serialized to storage and never sent over the network.
Ciphertext, and not much else.
What crosses the network is the encrypted blob and the IV needed to decrypt it. Your passphrase does not. The key derived from it does not. That is what makes the zero-knowledge claim checkable rather than promotional — you can read the derivation in src/lib/crypto.ts and confirm it yourself.
The key travels in the part of the URL browsers never send.
Sharing a note generates its own key rather than exposing your vault key, and puts it in the URL fragment — the portion after #, which browsers do not transmit to the server. A share can carry its own password, an expiry, and can be revoked early.