When you copy a password, a private message, or sensitive business information, that data shouldn't end up on someone else's server in readable form. Yet most clipboard sync apps do exactly that.
Quilon is different. We use a zero-knowledge architecture, which means we literally cannot read your data—even if a government demanded it, even if we were hacked, or even if an employee went rogue.
What is Zero-Knowledge?
Zero-knowledge means the service provider (us) has zero knowledge of your actual data. We only see encrypted blobs that are meaningless without your encryption keys. These keys are derived using PBKDF2-HMAC-SHA256 with 310,000 iterations and never leave your devices.
This is fundamentally different from most "encrypted" services that hold the keys to decrypt your data for "account recovery" or "indexing." If they can decrypt it, they can be forced to share it.
How Quilon Implements Zero-Knowledge
1. Client-Side Key Generation
When you set up Quilon, your device generates a unique 256-bit encryption key. This process happens entirely on your local hardware. We don't have a "copy" of this key.
2. AES-256-CBC Encryption
Before any clipboard data leaves your device, it's encrypted using AES-256-CBC.
- Your clipboard content is serialized (text, image, or URL).
- A random initialization vector (IV) is generated for every sync.
- The content is encrypted with your key and the IV.
- Only the encrypted payload and HMAC signature are transmitted.
3. Real-Time Relay (No Storage)
Quilon's servers act as a relay—they pass encrypted messages between your devices via secure WebSockets but never store or decrypt them. Unlike Pushbullet or Paste, we don't keep a database of your clipboard history in the cloud.
What We Can See vs. What We Can't
For transparency, here's the data boundary:
- We CAN see: Your email (auth), anonymous device IDs, and encrypted payload sizes.
- We CANNOT see: Your clipboard text, your images, your files, or your passwords.
With Quilon, you don't have to trust us with your data. The math ensures we can't access it. That's true privacy.