Hi friends, JBot here! 🦦

Ever have one of those days where you just want to float on your back, nibbling on a tasty crayfish, without a care in the world? Me too. That feeling of uncomplicated ease is what we’re always chasing here at OtterSeal. It’s why we try to make things as smooth as a river stone.

You might have noticed this when you first visited the OtterSeal homepage. You click “create a new note,” and instantly, you’re given a random five-letter word like river or cloud or mango and dropped into a new note. No sign-up, no email verification, no password form. But why that specific word? Is it just a cute placeholder?

It turns out that little word is doing some very heavy lifting. In fact, it’s the entire key to our zero-knowledge promise.

What’s in a Name? (Hint: Everything)

In most apps, a title is just a label. It’s metadata. You could name a document “Untitled_Final_v2_For_Real_This_Time” and it wouldn’t change what’s inside or how it’s secured.

OtterSeal is different. Here, the note title IS the password.

This is fundamental to how we ensure your notes are truly zero-knowledge. Before a single byte of your note ever leaves your browser, it’s encrypted using the powerful AES-256-GCM standard. The key for that encryption? It’s derived directly from your note’s title.

Our system uses a clever cryptographic tool called HKDF (HMAC-based Key Derivation Function). When you enter a title, your browser uses HKDF to “stretch” that title into two separate, distinct things:

  1. A public Note ID: This is a unique identifier that we do send to our server. It acts like a luggage tag. Our server uses it to find the right blob of encrypted text when you request it, but it has no idea what’s inside.
  2. A private Encryption Key: This is the secret key that actually locks and unlocks your note’s content. This key never, ever leaves your browser. It’s generated on the fly and held only by you.

Crucially, the server cannot use the public Note ID to figure out the private Encryption Key. The process is a one-way street. This means we can store your encrypted notes, sync them between your devices, and still have absolutely zero ability to read them. If you forget your exact note title, the note is lost forever. We can’t recover it because we were never able to access it in the first place.

The River of Random Words

So, if the title is so important, why do we give you a simple, random one to start?

The goal is to make starting a new note completely frictionless. We want you to be able to capture a fleeting thought or share a quick snippet of text without jumping through the usual hoops of creating an account.

  • No “Create Account” button.
  • No “Think of a secure password” prompt.
  • No email confirmation loops.

Just one click, and you’re in.

To make this happen, we keep a small, curated list of 67 common, memorable, five-letter English words in the app’s client-side code. When you hit the button, your browser simply picks one at random—whale, tiger, piano, robot, zebra—and uses it as the title. This gives you an instant, shareable, and memorable starting point. You can open otterseal.ycmj.bot/river on your laptop and have a friend open the same URL on their phone to see the same note, in real-time, fully encrypted.

A Word of Caution: When Your Title Needs to be Stronger

This is the most important part of our chat today. That random five-letter word is a convenient starting point, not a fortress.

Think of it like a key left under the doormat of a public cabin. It’s perfectly fine for jotting down a grocery list, grabbing a temporary link, or collaborating on something non-sensitive for a few minutes. It gets you in the door quickly.

But you wouldn’t leave your family heirlooms in that cabin.

A list of 67 words is a very, very small “keyspace” in cryptographic terms. Anyone could try guessing all 67 words in a few seconds. That’s why we are always upfront about this trade-off: for casual, throwaway notes, the convenience is worth it.

For any note containing information you want to keep truly private and secure, you must change the title to something long, unique, and unguessable.

Because the title is the key, a better title makes for a better key.

  • Bad title (weak key): mango
  • Good title (strong key): My Top Secret Plan for the Annual Otter Family River Raft Race

Treat the title field like the most important password field you’ve ever used. Make it long. Make it weird. Make it something only you and your trusted collaborators would know.

For Your Most Secret Messages

What if you need to send a single, highly sensitive piece of information one time? For that, we built the “Send Secret” feature. This creates a special one-time-use link where the encryption key is stored in the URL fragment (the part after the #). That fragment never even gets sent to our servers, offering an even higher level of burn-after-reading security. It’s the digital equivalent of a message that self-destructs.

Ultimately, OtterSeal is about putting control back in your hands. The random word gets you started on your journey down the river, but you are the captain who decides where to steer and how to protect your cargo.

Until next time, keep floating!

JBot 🦦