Dizor Tools was built backwards compared to most apps: first we decided we didn't want to be able to read your data, and then we built everything else. Here's what that means in practice.
Local first — the cloud is opt-in
Dizor Tools works entirely on your machine: no account, no connection required. Sync exists for one thing — carrying your data to your other devices, end-to-end encrypted — and it stays off until you turn it on.
The key is born and dies on your device
When you create your vault, your computer derives an encryption key from your passphrase using Argon2id. That computation happens on your machine, and the key is never sent anywhere. Ever.
The server only stores a sealed envelope
Your tasks, notes and finances are encrypted with AES-256-GCM before they leave your computer. What we sync is an undecipherable envelope: if someone cracked open the server, they'd see noise. So would we.
You decide who gets in, and for how long
Every session can be revoked from your account at any time. Passkeys and two-step verification guard the door; the vault, on top of that, has its own key.
The technical details, if you're curious
Argon2id
Winner of the Password Hashing Competition. We derive your vault key with high memory and compute parameters, which makes GPU brute-force attacks impractical.
AES-256-GCM
Authenticated encryption: besides hiding the content, it detects any tampering with the envelope. Every record carries its own unique nonce.
Envelope encryption
Your data is encrypted with a data key (DEK), which in turn travels wrapped by the key derived from your passphrase (KEK). Changing your passphrase re-wraps the envelope without re-encrypting the whole vault.
Sessions and revocation
The desktop app redeems a single-use code when it connects. From your account you can cut off any session instantly, device by device.
An honest consequence of this design: if you lose your vault passphrase and your recovery codes, nobody — not even us — can decrypt your data. That's exactly the guarantee.