Skip to main content

Encryption

For highly sensitive content, tagd-ai offers end-to-end encryption. Content is encrypted on your device before upload and can only be decrypted by those with the key.

How Encryption Works​

End-to-End Encryption​

  1. Content is encrypted on your device
  2. Only encrypted data is transmitted and stored
  3. tagd-ai servers cannot read your content
  4. Only someone with the decryption key can view

What's Encrypted​

  • All text content in the tag
  • File attachments
  • Image captions
  • Metadata (titles, descriptions)

What's Not Encrypted​

  • QR code/short ID (needed for routing)
  • Tag existence (tagd-ai knows tags exist)
  • Access timestamps (who accessed when)

Setting Up Encryption​

Enable on a Tag​

  1. Create or open a tag
  2. Go to Settings → Security
  3. Toggle End-to-End Encryption
  4. Create an encryption key
  5. Save the key securely - tagd-ai cannot recover it
Important

If you lose your encryption key, you lose access to the content. tagd-ai cannot help recover encrypted data.

Encryption Key Options​

Password-based:

  • You create a memorable password
  • Key is derived from password
  • Easier to remember, slightly less secure

Generated key:

  • Random cryptographic key
  • Very secure
  • Must be stored safely

Sharing Encrypted Content​

With Key Recipients​

To share encrypted content:

  1. Share the tag link as normal
  2. Share the decryption key separately
  3. Recipient enters key to view content

Key Distribution​

Share keys securely:

  • In-person verbal communication
  • Encrypted messaging (Signal, WhatsApp)
  • Secure password manager sharing
  • Never email keys with links

Team Access​

For team use:

  1. Use a shared password the team knows
  2. Or use a team password manager
  3. Key management is your responsibility

Viewing Encrypted Content​

As a Viewer​

  1. Open the encrypted tag
  2. See "This content is encrypted" message
  3. Enter the decryption key
  4. Content is decrypted locally
  5. You can now view the content

Session Persistence​

After entering the key:

  • Content viewable for session
  • Key isn't stored permanently
  • Re-enter key after browser close
  • Each device needs key entry

Key Management​

Storing Keys​

Recommended storage:

  • Password manager (1Password, Bitwarden)
  • Encrypted notes application
  • Physical safe (for critical keys)
  • Split key storage for high security

Key Rotation​

Periodically change encryption keys:

  1. Decrypt the tag
  2. Go to Settings → Security
  3. Click Change Encryption Key
  4. Enter new key
  5. Content is re-encrypted
  6. Distribute new key to authorized users

Multiple Keys (Pro)​

For different access levels:

  • Master key: Full access
  • Limited keys: Specific sections
  • Time-limited keys: Expire after period

Technical Details​

Algorithms Used​

  • Encryption: AES-256-GCM
  • Key Derivation: PBKDF2 or Argon2id
  • Integrity: HMAC-SHA256

Client-Side Encryption​

All encryption happens:

  • In your browser (JavaScript)
  • Before data leaves your device
  • Using Web Crypto API
  • With no server-side access

Zero-Knowledge​

tagd-ai operates with zero knowledge of:

  • Your encryption keys
  • Your decrypted content
  • Who has access (beyond access logs)

Use Cases​

Medical/Health Information​

HIPAA-sensitive data:

  • Patient information
  • Medical records
  • Health data

Financial Information​

Protect:

  • Banking details
  • Investment information
  • Tax documents

Secure:

  • Contracts
  • Legal proceedings
  • Confidential communications

Personal Secrets​

Store:

  • Passwords and credentials
  • Personal notes
  • Private information

Encryption vs Other Security​

Comparison​

FeaturePassword ProtectionEncryption
Server accesstagd-ai can readZero knowledge
Key recoverytagd-ai can resetNot possible
PerformanceInstantSlight delay
Use caseCasual privacyMaximum security

When to Use Each​

Use Password Protection:

  • Moderate sensitivity
  • Convenience important
  • Need password recovery option

Use Encryption:

  • Highly sensitive data
  • Compliance requirements (HIPAA, etc.)
  • Maximum security needed
  • Willing to manage keys

Combining with Other Security​

For maximum security:

  1. Two-factor authentication on account
  2. End-to-end encryption on tag
  3. Access logging enabled
  4. Strong encryption key

Layered Access​

Account (2FA required)
  └── Tag (Encrypted)
       └── Protected Fields (Password)

Limitations​

What Encryption Can't Do​

  • Protect against key compromise
  • Prevent screenshots after decryption
  • Stop authorized users from sharing
  • Recover data if key is lost

Performance Impact​

Encrypted tags:

  • Slightly slower to open
  • Larger storage size (encrypted)
  • Client processing required
  • Mobile devices may be slower

Troubleshooting​

Wrong Key Error​

  • Check for typos
  • Verify correct tag
  • Ensure complete key entry
  • Key is case-sensitive

Can't Decrypt​

  1. Verify you have correct key
  2. Check if key was changed
  3. Try different browser
  4. Contact person who shared key

Lost Encryption Key​

If you've lost the key:

  • Check password managers
  • Check secure notes
  • Ask anyone who has access
  • Data may be unrecoverable

Recovery Prevention​

Back Up Keys​

Before encrypting:

  1. Generate/create your key
  2. Store in password manager
  3. Create physical backup
  4. Test that backup works

Test Decryption​

After encrypting:

  1. Log out of tagd-ai
  2. Log back in
  3. Try decrypting with backed-up key
  4. Verify before adding sensitive content

Next Steps​