_the evening, see_
A local-first, encrypted personal diary.
Page https://ostefani.github.io/soirvu/
SoirVu keeps your diary in an encrypted vault on your own machine. It requires no account, runs no cloud service and makes no network connections. Unlock your vault with your passphrase or recovery key.
 |
 |
You can download unsigned installers or build from source. How to build from source see Building
Download an installer for your platform from GitHub Releases. Installers are unsigned; see BUILDING.md for platform instructions and release verification.
Open SoirVu, choose a location for your vault and create a passphrase. Save the recovery key shown during setup somewhere safe: it is shown only once.
- Subfolders and entry links — organize entries in nested folders and link related notes within the same vault.
- Encrypted vault — entries live in a SQLCipher database; attachments are stored as separately encrypted files. Keys are derived with Argon2id and wrapped in LUKS-style key slots, so changing your passphrase doesn't re-encrypt your diary.
- Recovery key — a randomly generated key shown once at setup lets you back in if the passphrase is forgotten. Without either, the diary is unrecoverable — by design.
- Markdown, always — entries are stored as Markdown and edited in a WYSIWYG editor built on ProseMirror. Export entries and attachments to a folder, or use
soirvu-clito verify or export a vault without the app. Exports are unencrypted. - Your choice of location — the vault is an ordinary folder: internal disk, external drive, or a mounted encrypted disk image.
- Backups and sync — make encrypted backups manually or on a schedule. Optional sync writes encrypted bundles to a separate folder that another tool or a USB drive can carry between devices.
- Encrypted full-text search — search runs inside the encrypted database; nothing is indexed in plaintext.
- Auto-lock — the vault locks on idle, sleep, screen lock or manual shortcut, and the keys are wiped from memory.
- Key management — change your passphrase, regenerate your recovery key or rotate the vault's master key in the app.
The Rust backend handles vault keys, cryptography and vault file operations. Encryption protects your diary at rest — it cannot protect text while you are reading it, so auto-lock exists to shrink that window. Keyloggers, screen recorders and a compromised OS are explicitly out of scope.
- Tauri v2
- Rust core (SQLCipher, XChaCha20-Poly1305, Argon2id)
- Svelte 5 UI
- ProseMirror editor with Markdown as the only stored format.
Prerequisites: Rust toolchain (via rustup) and Node.js 24 LTS. Full per-OS instructions live in BUILDING.md.
npm ci --ignore-scripts
npm run tauri build # local use: installers land under target/release/bundle/
npm run tauri dev # development with hot reload
# checks and tests
npm run check
npm test
cargo test -p soirvu-core -p soirvu-cli
# manual plaintext-leak test (needs a scratch vault)
sh scripts/leak-test.sh <path-to-test-vault-folder>
See CONTRIBUTING.md for development checks and contribution guidelines.
MIT © 2026 Olha Stefanishyna