End-to-end encryption, in plain words
"End-to-end encrypted" appears on a lot of apps. Here is what it actually means inside MoLock — with a locked box instead of maths — including the little the service can still see and what happens if you forget your password.
Mahmoud Mohamed · 6 min read
YOUR PC
Encrypted here
- Notes, reminders, clipboard
- Attempt photos & screenshots
- The key never leaves
MOLOCK SERVICE
Stores, cannot read
- Sees: type, time, size
- Never sees: text or photos
- Never knows your password
YOUR BROWSER
Decrypted here
- After your password + Telegram code
- On any device
- Every sign-in reported
A locked box whose key never leaves your hands
Imagine you want to keep a notebook in a storage unit across town. You could hand the notebook to the storage company and trust them not to read it. Or you could put it in a strong box, lock it with a key that you never give to anyone, and let the company store the box. They can tell you the box is there, how big it is and when you last dropped it off. They cannot read a single page.
That second option is end-to-end encryption. The two "ends" are you on your PC and you in your browser. Everything in between — the internet, the MoLock service, its storage — only ever carries the locked box.
YOUR PC
Encrypted here
- Notes, reminders, clipboard
- Attempt photos & screenshots
- The key never leaves
MOLOCK SERVICE
Stores, cannot read
- Sees: type, time, size
- Never sees: text or photos
- Never knows your password
YOUR BROWSER
Decrypted here
- After your password + Telegram code
- On any device
- Every sign-in reported
The "locking" is not a figure of speech. MoLock turns your content into scrambled data using a key, and without that key the scrambled data is meaningless — not hidden, not obscured, but genuinely unreadable. The same key turns it back into your note, your photo or your file, and that only happens on your PC or inside your own browser after you sign in.
What MoLock locks in the box
Since 2.6, your notes, to-dos, reminders and unlock history have travelled this way. With MoLock Account in 2.7, the list grows. All of the following are encrypted before they leave your PC or browser:
- Notes, to-dos and reminders — titles, text, times, repeats and sounds.
- Desktop sticky notes — the text, the colour and even where the note sits on your screen.
- Clipboard items you choose to sync to your phone.
- Unlock attempts and their photos — who tried, when and how.
- Photos and screenshots you request remotely from your account.
- The keys of your MoLock Vault.
- The contents of files you share by link, and files you send privately between your browser and your PC.
What the service can still see
A storage company that knows nothing at all cannot deliver anything. To keep your account working, the service needs a small amount of information that is not encrypted. We would rather tell you exactly what it is than say "everything is secure".
| Item | What the service sees | What it never sees |
|---|---|---|
| Notes, reminders, sticky notes, clipboard | That an item exists, its type, when it changed, its size | Any of the text or settings |
| Unlock history | The time, the kind of result, whether there is a photo | The photo itself or the details |
| Sign-ins to your account | Time, allowed or denied, approximate country and city, browser type | Your password |
| Shared files | Size, expiry, download count | The file's contents or its key |
Your account is identified by your Telegram user id and username, because that is how the official bot knows where to send your codes and alerts. Each sign-in is recorded with its time, its result, an approximate city and the browser type, so you can spot one that wasn't you.
Why your password is deliberately slow to guess
Your account password does two jobs. It proves to the service that you are you, and it is the raw material for the key that opens your boxes. The service never receives the password itself. Your PC or browser turns it into two separate values: one used to sign in, and one used to unlock your data. The service only keeps a check value of the first one — enough to say "yes, that matches", never enough to rebuild your password.
Turning your password into a key is designed to be slow on purpose: it takes a noticeable fraction of a second. You will never notice it when signing in. But someone trying to guess passwords has to pay that cost for every single guess, which turns millions of quick attempts into years of work. Add the rest of the safeguards — a six-digit code from Telegram on every new sign-in, a lockout after repeated failures — and guessing stops being a practical attack.
The service stores sealed boxes. Only your password makes the key.
If you forget your password
This is the part that surprises people. Because nobody else holds your key, nobody can recover the content stored in your account — not support, not the developer. There is no back door, because a back door for us would be a back door for anyone who broke in.
That sounds scary, but in practice very little is at risk. Your notes, reminders and history live on your PC first; the account holds encrypted copies. Set a new account password from MoLock on your PC and your PC simply locks its data again under the new key. Your lock screen password and your recovery code are separate, so a forgotten account password never locks you out of your own PC.
Share links: the key lives in the link
Share links work a little differently, because the person receiving the file does not have your password. Here, MoLock creates a brand-new random key just for that file, locks the file with it, and uploads only the locked file. The key is placed at the end of the link, after a # sign:
Share linkend-to-end encrypted
7ot.app/s/7Hq2Xk#k=Vb3pQe…9sLw
Reaches the service: the file number only
The key: stays in the link, never sent
Expires in 7 daysPassword3 downloadsDelete after first download
Browsers have a long-standing rule: the part of an address after # is never sent to the website. So when your friend opens the link, their browser downloads the locked file, reads the key from the address bar, and unlocks it right there on their device. The service delivered a box it had no way to open.
You can add more protection on top: an expiry from one hour to 30 days, a password the recipient must type, a maximum number of downloads, or "delete after the first download". The one rule to remember: anyone who has the full link can open the file, so send it to the right person, through a channel you trust.
The honest limits
Encryption is powerful, but it is not magic. These are the edges we want you to know about:
- Files you send to the bot are different. When you send a document or photo to @MoLockOfficialBot, Telegram has already seen it. MoLock stores those files encrypted on the service, but not end-to-end, and labels them so in your account.
- Whoever knows your password can try to sign in. That is true of any system. With MoLock they would also need the code sent to your Telegram, and every sign-in — allowed or refused — is reported to you, so you can change the password within seconds.
- Your PC must be trustworthy. Encryption protects your data in transit and in storage. If someone controls your unlocked PC, they see what you see. That is why the lock screen, auto-lock and the habits in 10 everyday privacy habits still matter.
- Some metadata is visible, as described above. It is kept to the minimum the service needs to work.
Where to go next
If you want the full picture of the account, including sign-in and security, read the MoLock Account page. To see how the same idea protects a whole drive on your PC, read Your encrypted vault drive. And everything MoLock stores, and for how long, is listed in the privacy policy.