Follow-up: I added key rotation to Kagelin's encryption. Here's how it works and what it still misses.

Achyuth S — Fri, 09 Oct 2026 05:30:30 +0000

In my last post I listed what Kagelin's client-side encryption doesn't cover. One gap was key rotation: if your key leaked, it stayed valid for the life of your account. v1.47.0 fixes that.

A little overkill for a todo app? Yes but I'm having fun building things I've never built!

Why changing your passphrase wasn't enough

Your passphrase only wraps the content key. Changing it re-wraps the same key. If someone already has the key, a new passphrase doesn't stop them.

What rotation does:

It makes a new content key. Old keys are kept only until all your data is re-encrypted, and then they're deleted.
It needs a new passphrase and gives you a new recovery code, because either one could be what leaked.
It signs out your other sessions.
The key swap is one server-side transaction. It commits fully or not at all, so you can't end up with a key that nothing can unwrap.
After the swap, the server rejects any write encrypted with an old key.

I didn't use a two-tier setup with a fixed master key that wraps a series of content keys. Anyone who held the leaked master key could still unwrap every new key.

Rotation only runs when you start it. It is never automatic.

Ciphertext is now tied to its row

Before this release, someone with write access to the database could move encrypted values between your rows, and the app couldn't tell. Now every value is sealed with its user, table, column and row id as associated data. A value moved anywhere else fails to decrypt.

To make this work, every encrypted table now generates its ids on the client, before encryption.

A value that can't be read no longer breaks the list

Before, if one value failed to decrypt, the whole query failed and you saw nothing. Now that one field shows "Can't be read" and the rest of the row still works. The app also won't write a row like that back to the server.

Devices that still have the old key

A device that missed the rotation tries to save with the old key, and the server refuses. The app then checks for a newer key. If there is one, the device locks and asks for your new passphrase. Changes on that device that weren't synced are discarded, and the unlock screen tells you so.

What it still doesn't cover

Replaying an older value. Someone could put an older encrypted version of a field back into the same row, and it would still decrypt. Catching that needs a version counter, which isn't built yet.
Backups. Nightly backups keep the old ciphertext and key wrappers for up to 30 days after a rotation. Protection is not instant.
Restoring the key row from an old backup. This locks out every device that has already unlocked with the newer key.
The same gaps as last time. A compromised browser tab (XSS) or a compromised build pipeline is still out of scope.

Try it:

app.kagelin.app · Achyuth072/kagelin (AGPL-3.0)

I shipped client-side encryption for Kagelin. Here's the honest threat model, including everywhere it still fails.

Achyuth S — Mon, 21 Sep 2026 06:09:18 +0000

A brief intro on Kagelin, its an AIO productivity tool that doesn't distract you. Task, habit, calendars are basis of this tool and much more planned.

Kagelin now encrypts your data client-side. The server never sees the key so a DB leak, a compromised server, or a legal request only gets ciphertext.

What's encrypted: task text, habit names, project/label names, calendar event details, push notification content.

What's not: dates, priorities, completion status, due dates. Those stay readable server-side so reminders and sorting still work. Same for basic account info like email, item counts.

What it doesn't protect against: a compromised browser tab (XSS), or a compromised build pipeline. Key rotation also isn't built yet.

Short version: Kagelin can't read what you wrote. It can see that your account exists and roughly how much is in it.

app.kagelin.app · github.com/Achyuth072/kagelin (AGPL-3.0)

If you've shipped E2EE before, how'd you handle key rotation?

DEV Community: Achyuth S

Follow-up: I added key rotation to Kagelin's encryption. Here's how it works and what it still misses.

I shipped client-side encryption for Kagelin. Here's the honest threat model, including everywhere it still fails.