SoirVu

_the evening, see_

A local-first, encrypted personal diary.

Page https://ostefani.github.io/soirvu/

SoirVu keeps your diary in an encrypted vault on your own machine. It requires no account, runs no cloud service and makes no network connections. Unlock your vault with your passphrase or recovery key.

Getting started

You can download unsigned installers or build from source. How to build from source see Building

Download an installer for your platform from GitHub Releases. Installers are unsigned; see BUILDING.md for platform instructions and release verification.

Open SoirVu, choose a location for your vault and create a passphrase. Save the recovery key shown during setup somewhere safe: it is shown only once.

Features

• Subfolders and entry links — organize entries in nested folders and link related notes within the same vault.

• Encrypted vault — entries live in a SQLCipher database; attachments are stored as separately encrypted files. Keys are derived with Argon2id and wrapped in LUKS-style key slots, so changing your passphrase doesn't re-encrypt your diary.

• Recovery key — a randomly generated key shown once at setup lets you back in if the passphrase is forgotten. Without either, the diary is unrecoverable — by design.

• Markdown, always — entries are stored as Markdown and edited in a WYSIWYG editor built on ProseMirror. Export entries and attachments to a folder, or use soirvu-cli to verify or export a vault without the app. Exports are unencrypted.

• Your choice of location — the vault is an ordinary folder: internal disk, external drive, or a mounted encrypted disk image.

• Backups and sync — make encrypted backups manually or on a schedule. Optional sync writes encrypted bundles to a separate folder that another tool or a USB drive can carry between devices.

• Encrypted full-text search — search runs inside the encrypted database; nothing is indexed in plaintext.

• Auto-lock — the vault locks on idle, sleep, screen lock or manual shortcut, and the keys are wiped from memory.

• Key management — change your passphrase, regenerate your recovery key or rotate the vault's master key in the app.

• Diary import retains unrecognized attachment formats for export and reports them separately.

• JSON imports allow up to 512 MiB per file and 256 MiB per decoded attachment. Markdown imports allow up to 256 MiB of linked attachments per note. Imports skip attachments beyond those limits and reject an oversized JSON file before parsing.

• Inline previews respect the current per-type attachment limits. Files above those limits remain available through external opening for supported formats or through export.

• Markdown planning accepts at most 20,000 directory items, 32 levels below the root and 64 MiB of note text per import. New entry writes and incoming sync records allow up to 4 MiB of body text, a 4 KiB title and 128 tags.

• Inline attachment responses are limited to 8 MiB. Larger previews require a webview that requests byte ranges. Supported files can still open externally.

• Passphrase operations accept vaults with up to 1 GiB of Argon2 memory and a combined memory-times-passes budget of 4 GiB-passes. Vaults with higher parameters can still be read using their recovery key.

• Exports publish complete files without replacing existing names. Export, attachment storage and vault copying require a filesystem that supports hard links, such as APFS, ext4 or NTFS. Use a supported local volume if a removable or shared volume cannot publish the files.

Security model

The Rust backend handles vault keys, cryptography and vault file operations. Encryption protects your diary at rest — it cannot protect text while you are reading it, so auto-lock exists to shrink that window. Keyloggers, screen recorders and a compromised OS are explicitly out of scope.

Import and export dialogs expire when their vault session ends. Once an authenticated export starts, locking waits for it to finish. Background reads and media playback do not reset the inactivity timer.

New passphrases require at least eight Unicode characters and at most 64 KiB. Existing shorter passphrases still unlock. If an old credential exceeds the byte limit, use the recovery key to open the vault. The inactivity timeout accepts 1 minute to 24 hours, and attachment size preferences accept 1 to 1024 MiB. The app asks for native confirmation before increasing those limits or disabling metadata stripping or clipboard clearing.

Cut and Copy use the system clipboard to preserve normal paste behavior. On macOS, Universal Clipboard may share copied text with nearby devices if Handoff is enabled. SoirVu's clipboard clearing option does not recall text that the system or another app has already read.

Windows clipboard history and sync and Linux clipboard managers may retain copied text. macOS Dictation is controlled by system settings and may send audio to Apple.

External links require confirmation and support HTTPS or a single mail recipient with optional subject and body. The app webview stays on its packaged origin or the configured development origin. Vault connections enable SQLite defensive mode and disable trusted schemas.

The vault schema checks entry and folder revisions, attachment sizes, and digest lengths on write. Upgrading a valid vault creates an encrypted pre-upgrade backup. If the upgrade finds invalid legacy metadata, it stops and preserves the existing rows for recovery. Older app builds cannot open the upgraded schema.

Photo metadata stripping is best effort for JPEG, PNG, and WebP attachments. Unsupported or malformed files can retain metadata. Diary interchange imports preserve their attachment bytes. Opening an attachment externally creates a plaintext copy that SoirVu clears on lock or startup. An external app may keep its own copy.

Tech

• Tauri v2
• Rust core (SQLCipher, XChaCha20-Poly1305, Argon2id)
• Svelte 5 UI
• ProseMirror editor with Markdown as the only stored format.

Building

Prerequisites: Rust toolchain (via rustup) and Node.js 24 LTS. Full per-OS instructions live in BUILDING.md.

npm ci --ignore-scripts
npm run tauri build    # local use: installers land under target/release/bundle/
npm run tauri dev      # development with hot reload

# checks and tests
npm run check
npm test
cargo test -p soirvu-core -p soirvu-cli

# manual plaintext-leak test (needs a scratch vault)
sh scripts/leak-test.sh <path-to-test-vault-folder>

See CONTRIBUTING.md for development checks and contribution guidelines.

License

MIT © 2026 Olha Stefanishyna