Courier locks a note on your device and keeps it locked until it reaches another one of your devices. The server in between stores and forwards files it cannot open: it never receives your vault password, and it never holds the key.
What the server can and cannot see
Section titled “What the server can and cannot see”| It can see | It cannot see |
|---|---|
| How many files and versions a vault has, and each file’s size | What any note says |
| When a version was saved, and which device saved it | File and folder names |
| Whether two files hold the same content, so it stores one copy | The vault password, or the key |
The last row deserves a sentence. The server recognises a file by a fingerprint of its content, so two identical files are stored once. A fingerprint says nothing about what the file contains — but if someone already had the exact same file, they could confirm that it is in your vault too.
Where the key comes from
Section titled “Where the key comes from”Your vault password becomes a key on your device: PBKDF2 with 600,000 rounds of SHA-256, giving a 256-bit AES-GCM key. The server keeps a random salt so that every device that knows the password arrives at the same key, and one small piece of ciphertext — a fixed string encrypted with that key — so that a new device can check a typed password without sending it anywhere.
This is the vault password, not the server’s login password; that one is used once, when you deploy the server.
The password itself never leaves the device it was typed on.
What follows from that
Section titled “What follows from that”There is no password reset. Nobody holds a spare key: not us, and not the person running the server. Forget the vault password and those notes stay locked, so keep it in a password manager and let the desktop app keep local backups.
The device is the boundary. Encryption covers notes on their way to the server and while the server holds them. On your own computer they are ordinary files: anything that can read your disk can read them.
See for yourself
Section titled “See for yourself”Courier is open source. Deriving the key, encrypting and decrypting all happen on your device, in the Obsidian plugin and the command-line tool, in code you can read on GitHub. Nothing about the encryption asks you to trust the server.