Encryption & recovery keys
ShrinkNotes end-to-end encrypts your Private Process Notes so that only you can read them — not ShrinkNotes, and not anyone who subpoenas ShrinkNotes. Here is how it works and how to keep your access safe.
What does end-to-end encryption protect?
ShrinkNotes keeps two kinds of notes. Your Private Process Notes — the heart of your clinical thinking — are end-to-end encrypted. Your Official Chart Notes are stored normally so they stay legally available. Encryption applies to the private notes only.
What ShrinkNotes cannot read:
- Your Private Process Notes
- Your recovery key and encryption settings
What ShrinkNotes can see (stored normally):
- Official Chart Notes (legally required)
- Basic account info such as your email and practice name
- Appointment times and basic scheduling
How does ShrinkNotes encrypt my notes?
Encryption happens in your browser using the Web Crypto API. Your notes are encrypted with AES-256-GCM. The key that protects them is derived from your password using PBKDF2 with 600,000 iterations (SHA-256). That key never leaves your device and is never sent to ShrinkNotes.
How do I turn on encryption?
You can enable encryption at signup or later from your security settings:
- Start the Enable End-to-End Encryption flow.
- Enter your ShrinkNotes password to confirm it is you.
- ShrinkNotes generates your encryption keys in your browser.
- Save the recovery key shown on screen — this is the only time it appears.
- Check “I have saved my recovery key in a secure location” and click Complete Setup.
What is the recovery key, and why does it matter?
Your recovery key is a 12-word key generated during setup. Behind the scenes, ShrinkNotes stores a second encrypted copy of your encryption key that only your recovery key can unlock. That way, if you ever forget your password, you are not locked out of your own notes — but no one without your recovery key can get in either. Store it somewhere safe and separate from your password; it is shown only once.
What happens if I forget my password?
Use your recovery key to restore access and set a new password:
- On the login screen, choose account recovery.
- Enter your email, your 12-word recovery key, and a new password.
- ShrinkNotes unlocks your encryption key in your browser and re-encrypts it under your new password.
Your note contents are never transmitted or stored by ShrinkNotes in readable form during this process.
How do I generate a new recovery key?
You can rotate your recovery key from Settings → Security. Generating a new recovery key invalidates the old one, so update wherever you store it. Recovery-key options become available once you have enabled both two-factor authentication and encryption.
Related
- Encrypted session notes for therapists — what end-to-end encryption means for your notes.
- What are process notes? — the private notes this encryption protects.
- Can therapy notes be subpoenaed? — what encryption does and doesn’t shield.