Encryption Design

In an era where everything resides in the “cloud,” we’ve grown accustomed to uploading our diaries, study notes, and important documents to the internet. But this also means that when there’s no network, a server failure, or a service policy change, your digital assets could become inaccessible.

Easchi has chosen a different path. Right from the foundational design, we established the core principles of local-first and privacy-focused. The app can run entirely on a single machine, and files synced to the cloud remain in an encrypted state — we are merely building you a lock and a secure room.

Data Backup and Recovery

⚠️ Warning: After setting a password, be sure to back up the configuration files. With only the password and without the original configuration files, data recovery will be impossible.

When restoring on a new device, you need both your password and the configuration files to decrypt correctly.

The specific steps are as follows:

1. After setting a password when opening the app for the first time, immediately back up all files in the configuration directory.
2. When using on a new device, you can first set an arbitrary password, unlock it, and then check the configuration directory path in the settings.
3. Delete the files in this directory and place the previously backed-up configuration files into it.
4. Restart the app and enter the original password.

🛠️ Three Layers of Protection: The Tiered Encryption System

To handle various life and work scenarios, all encryption operations in Easchi are performed directly on the local device. The system derives a high-strength underlying key from the strong password you set, providing three levels of encryption protection:

1. Single-file encryption — For sensitive content

This allows you to individually encrypt specific sensitive notes within your user directory (such as a diary, account password memos, or business secrets). Before decryption, external tools cannot read their content.

2. Full directory encryption — Building a complete defense line

Encrypt all notes, image attachments, and card metadata under a specified workspace directory, transforming them into a pile of indecipherable code.

3. Filename encryption — Complete invisibility

Sometimes, hiding the content alone is not enough; the titles of files (like “2026 Year-End Financial Report”) can also expose privacy. Easchi supports encrypting filenames.

• After encryption, the real filenames are hidden, and the file names on disk become meaningless characters like 018f3d1a-5b7c-7000-8000-000000000001.
• The underlying mapping data of real filenames is automatically and securely handled by Easchi within an encryption sandbox, ensuring absolute anonymity at the storage level.

💡 Scenario: In the system’s file manager, outsiders see nothing but a heap of gibberish and cannot find any trace of you through keyword searches, achieving true “total invisibility.”

⚠️ Password Security Warning Because Easchi strictly adheres to the principle of data localization, your password has never been and will never be uploaded to any server; it exists only in your brain and on your local device. Please keep your password and configuration files properly. Once lost, locally encrypted data can never be recovered.