Your bookmarks,
encrypted and private.

When you register, your browser generates a cryptographically random 256-bit Secret Key using crypto.getRandomValues() — the same Web Crypto API your browser uses for TLS. This happens entirely inside your browser tab.

The key is displayed to you once, formatted as LL-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX. You are responsible for saving it — Bkmker never receives, stores, or transmits it.

Each vault has a random 256-bit salt stored on the server. When you unlock, your browser combines your Secret Key with that salt using PBKDF2-SHA256 with 600,000 iterations to produce the vault's AES-256 encryption key.

600,000 iterations is the OWASP-recommended minimum for PBKDF2-SHA256 as of 2024. It means an attacker who stole your encrypted bookmarks and your vault salt would still need to brute-force your Secret Key across 2²⁵⁶ possibilities — computationally infeasible.

When you save a link, your browser encrypts the entire payload — URL, title, tags, notes, and description — using AES-256-GCM. A fresh random 96-bit nonce is generated for every single bookmark, so no two ciphertexts are ever identical even if the content is the same.

GCM mode provides both confidentiality and authentication. The authentication tag means any tampering with the ciphertext is detected and rejected before decryption. The server receives and stores only the ciphertext and nonce — it has no access to the key.

Our database contains no readable information about your browsing. Here is a representative row from what is actually stored — every field is either opaque binary data or structural metadata needed to serve it back to you.

When you open your vault, the server sends back the encrypted blobs. Your browser re-derives the vault key from your Secret Key (or PIN), then decrypts every bookmark locally using the Web Crypto API — the same built-in API used by your browser for HTTPS.

Decrypted bookmarks exist only in your browser's memory for the duration of your session. They are never written to disk and never sent anywhere. Closing the tab discards them entirely.

The IndexedDB cache stores only the encrypted blobs — the same format as the server. Even if someone extracted your browser's local storage, they would see only ciphertext.

Typing a 64-character key every session would be tedious. Bkmker lets you set a PIN that encrypts your Secret Key locally on your device. The PIN never leaves your browser — it is used purely to encrypt and decrypt a locally stored blob using its own PBKDF2-derived key (200,000 iterations, SHA-256).

The encrypted blob is stored in localStorage. The PIN salt, nonce, and ciphertext are all stored together — but without the PIN itself they cannot be used to recover the Secret Key.