▸ a random 256-bit key is generated locally

▸ AES-256-GCM encrypts the note before any network hit

▸ the key never leaves your browser — it lives in the URL fragment