How the encryption works
Sealed on your Mac.
Cappture Cloud is end-to-end encrypted. Here is how, step by step, as the app does it.
From your Mac to our storage
Eight steps. Each one is in the app's code, and nothing here is rounded up.
- 01
Your Mac makes a library key
When you turn Cloud on in Cappture’s Settings, Cloud, that Mac makes a random 256-bit library key. It is kept in the Mac’s Keychain, for that Mac only, and never synced through iCloud. On a personal licence every Mac that turns Cloud on gets a library, and a key, of its own.256-bit · Keychain, this device only
- 02
It shows you five security keys, once
At the same time it makes five security keys: 25 characters each, in five groups, from 32 letters and digits with the look-alikes left out. You see them once. They are never sent anywhere.K7Q2M-W9DXR-3HTPA-N4ZLC-E8VJY (an example)
- 03
The library key is locked five times
From each security key, HKDF-SHA256 makes a wrapping key, and the library key is sealed under each one with AES-256-GCM. Those five sealed copies are what the server gets. Any one security key opens the library key again; none of them can be worked out from what we hold.HKDF-SHA256 · salt "cappture-cloud-v1" · info "library-key"
- 04
Each capture is sealed with a key of its own
Every photo, screenshot and recording gets a fresh 256-bit key and is sealed with AES-256-GCM on your Mac, before anything is uploaded.AES-256-GCM · 12-byte nonce · 16-byte tag
- 05
Its name, kind and time are sealed too
The file’s name, whether it is a photo or a recording, and when you took it are each sealed with the library key. So we can’t see what anything is called, what it is, or when it was taken.name, kind, takenAt → sealed with the library key
- 06
The capture's key is locked by the library key
Its own key goes up only sealed by the library key, so opening any capture needs the library key first, and that is only on your Macs.capture key → AES-256-GCM under the library key
- 07
Only ciphertext is uploaded
The server stores the sealed bytes, how big they are, and the sealed key, name and details beside them. Up to 500 MB a capture. If a byte were changed on the way, its tag would not match and your Mac would refuse it.ciphertext · size · wrapped key · ≤ 500 MB
- 08
A share link carries its own key
A link is sealed apart from your library, with a fresh 256-bit key, in 4 MB chunks. The key is in the link after the#, which browsers never send to a server; the recipient’s browser opens the file itself. Up to 500 MB a file.cloudlink.getcappture.com/<id>#<key>
What we hold, and what we can't. To sync and to share, the server needs a few plain facts. Never a key that opens anything.
What we hold
On our servers
- Your captures, as ciphertext, and how big each one is
- When each was uploaded
- Each capture's key, its name, kind and time, all sealed
- Your library key, sealed five times by keys we never see
- A hash made from each security key, to find your Cloud on a new Mac; it opens nothing
- The names your Macs report, so you can tell them apart
- Share links' sealed files, their sizes and types, and when they expire
What only your Mac holds
Never sent to us
- The library key, in each Mac's Keychain
- The five security keys, wherever you wrote them down
- Every capture's own key, unsealed
- What your captures are called, what they are, and when you took them
- A share link's key, which lives in the link itself
Captures uploaded by versions of Cappture from before the details were sealed still show their kind and the time they were taken to the server. Their pictures and names were always sealed.
There is no reset. A reset would mean we had a way in.
As long as a Mac has its Keychain, its Cloud opens there. If that Mac is gone, type any one of its five security keys on a new Mac and it takes that Cloud over.
Lose the Mac and all five keys, and nobody can open that Cloud. Not you, not us. Keep the keys somewhere safe.
Your dashboard account is separate from all of this. Signing in shows you your links, Macs and billing; it can’t open a single capture.