Is my journal app actually secure? The honest answer, and the methods we chose

The short answer: secure enough that someone who stole our whole server would get nothing they could read, but no app is perfectly secure, and we won't tell you ours is. This post says what Awaken Journal by Everything Awaken protects you from, the methods we chose and why we chose plain, well-tested ones, how we hold ourselves to them, and what we haven't done yet.

The last six posts each answered one privacy question. This one steps back and asks the bigger one.

"Secure" always means "secure against what?"

Security isn't one switch. It's a list of people you're keeping out, and an honest answer goes through them one by one.

• Someone reading your writing on our server. Designed out. We only ever hold your writing as scrambled text, and we don't have the key. That includes us, a court order, and anyone who breaks in, as the post about the builders explains.
• Someone guessing their way into your account. Slowed down and limited. Every guess is expensive, and repeated wrong guesses lock the account for a while.
• Someone getting in through a weakness in the app itself. Reduced by a written checklist of 47 controls, checked against our running code.
• Someone who has your password, or your unlocked phone or computer. This is the one the design can't stop. If someone can unlock your journal the way you do, the app treats them as you.

The methods we chose, in plain words

When you sign in, your password is turned into two separate things: a proof that tells our server it's you, and a key that stays on your device and unlocks your writing. Everything below serves that split.

• Argon2id does the turning. It's deliberately slow and memory-hungry (19 MiB of memory and two passes, the baseline OWASP recommends), so anyone trying to guess passwords by the billion pays for every single guess. The next post goes deeper into it.
• Two separate salts mean the proof and the key are made along different paths. The proof we store can't be turned back into your key.
• A pepper, a secret kept outside our database, is mixed into the stored proof, so a copied proof is useless for testing guesses or signing in. Against a stolen database, what protects you is Argon2id's slowness and the length of your password.
• AES-256-GCM locks every entry with your key. It also detects tampering: if anyone changes a single character of the scrambled text, unlocking fails instead of showing you altered words.
• A fresh random starting point for every save. The same sentence saved twice looks completely different each time, so nobody can spot repeats.
• Your browser's own cryptography does the locking. The encryption runs on code built into Chrome, Safari, Firefox and Edge. The only outside library is an open-source Argon2 implementation.

Why plain methods, not clever ones

Every method above is published, tested by people who aren't us, and used by a very large number of other apps. That's on purpose. The classic mistake in security is inventing your own scheme, because nobody else has tried to break it yet.

The settings are fixed for good. The web app, and the Android and iPhone apps when they arrive, must all produce exactly the same results from the same inputs, byte for byte. We publish the test cases that prove it.

Encryption is only half of it

An app can have perfect encryption and still lose to a missing limit on login attempts or an out-of-date library. So beside the encryption we keep 47 controls in nine areas, checked against OWASP's Application Security Verification Standard and verified one by one against our running code. A few of them:

• Login attempts are rate-limited, and repeated failures lock the account with a reply that looks exactly like a wrong password, so nobody learns which accounts exist.
• Your sign-in lives in a cookie that page scripts can't read and other websites can't use, and it expires on its own. On the web, signing in somewhere new signs out every other session.
• No third-party scripts, fonts or trackers run in the app. Every file comes from us.
• Our logs never contain what you write, your keys, or the contents of any request.
• Backups are encrypted before they leave the server.
• Libraries are scanned every week, and serious problems are fixed within seven days.

On 1 October 2026 the count was 47 of 47. The full list is in the Awaken Journal Standard.

What we haven't done yet

A security answer with no gaps in it isn't honest. These are ours:

• The 47-point review is our own. No outside firm has audited Awaken Journal yet. When one has, the Standard will say who and when.
• Two rehearsals are still ahead of us: restoring everything onto a freshly rebuilt server, and walking through our incident plan end to end. Both are scheduled before the first test build of the phone apps.
• The web app's code comes fresh from our server each time you open it. You're trusting that it's the same code every visit. The phone apps, installed once from the store, narrow that gap.
• Only the encryption code is public. The rest of the app's code is private for now.

What makes it stronger on your side

The design protects your writing from everyone except someone who can unlock it the way you do. So the parts that are yours matter:

• Use a long, unique password, a short sentence works well, and don't reuse it anywhere.
• Don't stay signed in on a computer other people use.
• Download a backup from time to time, because a forgotten password can't be reset. The forgotten-password post explains why.

Check it yourself

• Our encryption code, its test cases and an independent checker are public on GitHub. With Python installed, python verify-vectors.py vectors.json re-checks every case with different libraries and reports 59 checks passed, 0 failed.
• Read all 47 controls in the Standard.
• Watch what leaves your device with the five browser checks from the last post.

Quick answers

Is Awaken Journal secure?

Your writing is encrypted on your device with AES-256-GCM, with a key made from your password by Argon2id, and we never hold that key. Around that sit 47 security controls checked against OWASP's standard. No app is perfectly secure, and the post lists what isn't done yet.

What encryption does Awaken Journal use?

AES-256-GCM through your browser's built-in cryptography, with a fresh random starting value for every save. Your key comes from your password through Argon2id (19 MiB of memory, two passes).

Has Awaken Journal been independently audited?

Not yet. The 47-control review is our own, checked against our running code. The Standard will name the outside firm and the date when that happens.

What's the weakest point of an encrypted journal app?

Your password and your unlocked devices. Anyone who can unlock your journal the way you do can read it, so use a long, unique password.

Is AES-256 encryption safe for a journal?

AES is the encryption standard published by NIST and built into every modern browser. With a properly made key it isn't broken by guessing. The realistic risks are around it: weak passwords, unlocked devices, and the app's own code.

Where to go next

The next post in Chapter 2 opens the first method up: we never had your password, how Argon2id and the pepper work, and where your key actually lives.