Security
End-to-end encrypted, blind by design
Your data is encrypted on your device before it’s ever sent. The server that syncs it stores and relays opaque ciphertext and never holds a key — so it cannot read your medicines, doses, or the names of the people you track.
- One recovery phrase 24 BIP39 words derives your master key
- Master key encrypts your keystore the list of spaces you belong to
- Group key encrypts one space's documents every dose, encrypted
Stores & relays encrypted blobs. Fans out live updates. Cannot decrypt anything.
Why it’s secure
-
End-to-end encrypted
Encryption and decryption happen only on your devices. Plaintext never leaves the device.
-
The server is blind
It's untrusted infrastructure by design: it stores and relays ciphertext and never holds a key. Compromising the server leaks nothing readable.
-
No accounts, nothing to breach
No email, no password, no profile. There's no user database to leak — just anonymous encrypted blobs keyed by hashes.
-
Open source
The apps, the encryption core, and the server are all public. Inspect the crypto or self-host the server — you don't have to take our word for it.
-
Standard, modern crypto
libsodium primitives (XChaCha20-Poly1305, BLAKE2b) and BIP39 phrases. No custom cryptography.
-
Works offline
A PWA with a local encrypted cache — it works without a connection and syncs when it's back.
The encryption, specifically
Everything is built on libsodium via its audited bindings — no home-rolled cryptography.
| Concern | Primitive | Notes |
|---|---|---|
| Symmetric encryption | XChaCha20-Poly1305 | libsodium authenticated encryption (AEAD), fresh 24-byte random nonce per message |
| Key derivation / hashing | BLAKE2b | derives sub-keys and the group / keystore identifiers from keys |
| Recovery phrase | BIP39 (24 words) | encodes a 32-byte master key you can write down |
| Keys / randomness | OS CSPRNG | 32-byte keys from libsodium randombytes |
The chain of keys
- Master key — 32 random bytes; your 24-word phrase is that key in BIP39 form.
- Keystore — your list of spaces, encrypted with the master key and stored as one opaque blob, addressed by a hash of the master key. The server holds it but can't decrypt it.
- Group key — encrypts one space's documents. Its server address is a hash of the key and reveals nothing about it.
- Documents — every dose is
XChaCha20-Poly1305(group key, JSON)with a fresh nonce. The server sees ciphertext, a version number, and a change counter — never plaintext.
Limitations & honest caveats
Credibility matters more than marketing, so here's the honest list. None of this is unique to Next Dose — it's the shape of any serious end-to-end encrypted, account-free tool.
-
Your recovery phrase is the single secret
There's no password and no second factor. Anyone who obtains your 24 words can read and change everything in every space you're in — like a password manager's master secret or a crypto wallet seed. The phrase encodes the key directly, so treat the words like a house key.
-
Lose the phrase, lose the data — there is no reset
Because we hold no keys and no account, we cannot recover or reset anything. If every device is lost and the phrase isn't written down, the data is gone.
-
Sharing a space shares its whole history
Handing someone a group key gives them everything in that space. Removing a member is advisory — roles are enforced by the app, not the server, and a member who has already seen the key can't be un-taught it (no automatic key rotation today). Share only with people you trust.
-
The server sees metadata
It never sees your data, but it does handle opaque random-looking identifiers, the size and timing of encrypted blobs, and connection metadata such as your IP address. It cannot see contents, names, or who is in a space.
-
A space address is a bearer capability
Anyone who learns a space's identifier can fetch its ciphertext (still undecryptable without the key). Keep invite links and QR codes private.
-
No forward secrecy
Group keys are long-lived; the model is encrypted document storage, not a messaging ratchet. Appropriate for a personal/family suite, but worth stating.
Threat model in one line. The server is untrusted infrastructure — compromising it leaks nothing readable. Compromising your recovery phrase exposes every space it's in. Same trade-off as a password manager, appropriate for a personal/family suite.
Read it, then trust it
The apps, the encryption core, and the server are all open source — inspect exactly how this works, or run your own server.