A kanban board with end-to-end encryption: what it means in practice
Updated 22 September 2026
Most task tools say they "encrypt" your data. Usually that means they encrypt it on the server's disk and hold the key as well. The provider can therefore read your tasks; it simply tends not to.
End-to-end encryption means something else: the key exists only on your side and never reaches the server. Encrypting and decrypting both happen in your browser. What leaves for the server is a block nothing can read without the key.
What we can see
Specifically, whatever is left once the data cannot be decrypted:
- That an account exists, labelled with a random identifier. Not your name, because we do not have it.
- Encrypted blocks of data and the time they arrived.
- How many of those blocks there are and how large they are.
What we cannot see
- The names and descriptions of your tasks.
- What your projects are called, or how many there are.
- Comments, notes, documentation or attachments.
- Who you share anything with.
The backup phrase
The key takes the form of 24 words. It is the same way of writing one down that cryptocurrency wallets use, because the problem is the same: how a person can store a random key and still copy it out without a mistake.
The phrase is generated in your browser the first time you open the app and never leaves it. It does two things: it unlocks the data on another device, and it restores the data if you lose a device.
Save it before you put anything you care about into the app. A password manager is a good place. So is paper in a drawer. A message to yourself in a chat is not, because that travels through someone else's server.
If you lose the phrase
The data is gone for good. This is not a strict support policy that a complaint could get around. The key is not held here, so there is nobody who could decrypt that data.
It is the other side of the same coin: the property that keeps strangers out of your tasks is the one that keeps you out of them without the key. Anyone who wants the certainty of a password reset by email needs a tool that holds the key for them.
What to watch out for
- A browser set to clear data on close. Corporate policies do this routinely, and it takes your local database with it. Without a saved phrase the data cannot be brought back.
- A private window. Once it closes, everything is gone.
- A shared computer. The data stays unlocked in the browser until you sign out.
What about shared projects?
A shared project has its own key, which everyone you share it with receives. Nothing changes for us: only encrypted content ever reaches the server. It changes for you, because more people hold the key and the project is readable by anyone who has the link.
Try it out
An account is created in your browser in a moment. We want neither your email address nor a card.
Open App