Security

CurbPage is local-first and encrypts sensitive data at rest.

What is encrypted

• OTP secrets: encrypted with a per-device auto-generated key (the account encryption key) before storage.
• Password-locked profiles and exports: AES-GCM with key derivation from the password.

What is not sent

Bookmark operations, OTP generation and encryption all happen in the browser. Nothing leaves the device unless you enable sync, or use classification (title and URL only).

Keeping your data yours

You can export all of your data at any time. There is no vendor lock-in, and uninstalling the extension removes its local database.