One of the first questions people ask when they hear about an encrypted journaling app is:
"How do I know your encryption actually works?"
It's a fair question.
If you're asking users to trust you with their most personal thoughts, simply saying "we use AES-256" isn't enough.
Trust shouldn't depend on marketing copy.
It should be something people can verify.
That's why we've decided to open-source the core encryption model and privacy-preserving search architecture behind RozVibe.
Not because it's perfect.
But because we believe security gets better when it's open to scrutiny.
Security Through Transparency
There's an old principle in cryptography known as Kerckhoffs's Principle:
A cryptographic system should remain secure even if everything about the system is public—except the secret key.
In other words, good security doesn't come from hiding your implementation.
It comes from building an implementation that remains secure even when everyone can inspect it.
That philosophy influenced our decision.
Instead of asking developers to simply trust our claims, we'd rather let them read the code, understand the architecture, and question every design decision.
What We Open-Sourced
The repository includes the core privacy architecture used by RozVibe, including:
- AES-256-GCM client-side encryption
- PBKDF2 key derivation (100,000 iterations)
- In-memory key lifecycle
- Deterministic key reconstruction for multi-device sync
- Privacy-preserving blind search indexing
- Local SQLite search database
- Search tokenization using HMAC-SHA256
These aren't isolated examples.
They're the same architectural ideas that power the application itself.
Why Open-Source Something Security-Critical?
Some people assume that publishing security-related code makes software less secure.
In reality, the opposite is often true.
Open implementations allow developers to:
- inspect assumptions
- identify weaknesses
- suggest improvements
- verify security claims
- learn from real-world implementations
No implementation is perfect.
Including ours.
That's exactly why we want more experienced engineers to review it.
If there's a better approach, we'd rather discover it now than after thousands of people depend on the software.
What You Can Learn From It
Even if you're not building a journaling app, the repository demonstrates several concepts that appear in many privacy-focused applications:
Client-side encryption
Keeping plaintext on the user's device instead of the server.
Deterministic key derivation
Reconstructing encryption keys securely without storing them directly.
Blind indexing
Searching encrypted content while keeping the server unaware of both the journal content and the user's search queries.
Local-first architecture
Moving sensitive computation from the cloud to the user's device.
These patterns aren't limited to journals.
They apply to password managers, medical software, private note-taking apps, secure messaging systems, and many other privacy-first products.
We're Still Learning
RozVibe is still in its early stages.
The architecture has evolved significantly since the first prototype, and I'm certain it will continue to evolve as we receive feedback.
Open-sourcing the project isn't me saying,
"This is the correct way."
It's me saying,
"This is how I solved the problem. Tell me where I can do better."
If you notice security concerns, architectural issues, performance bottlenecks, or simply have a different perspective, I'd genuinely appreciate hearing it.
Constructive criticism is one of the fastest ways to improve software.
Explore the Repository
If you're interested in Flutter, encryption, privacy-first software, or secure application architecture, I'd love for you to take a look.
📂 GitHub Repository:
https://github.com/RoninYT9/RozVibe
If you'd like to see the architecture running inside a real application, RozVibe is also available on Google Play.
📱 Google Play:
https://play.google.com/store/apps/details?id=com.SezRonix.RozVibe
Whether you review a single function or the entire architecture, thank you for taking the time.
Building privacy-first software is a continuous process, and every piece of feedback helps make RozVibe a little better.
I'm looking forward to your thoughts.
Top comments (2)
Small heads up: the GitHub and Google Play links in the post are still the placeholder text rather than real URLs. Worth fixing fast, since the whole argument here is that people can go and check the code themselves.
On the substance, open sourcing only the crypto layer is the right call. That is the part that has to be auditable, and the rest is your product.
Thanks a lot for your suggestion, I have tried fixing those issues in the post you can check urls now and let me know if they still have the issue.