Security

We built Dollarz so we can't read your budget.

Everything you enter is encrypted in your browser before it's saved. Here's exactly how that works, what we do store, and the limits you should know about.

AES-256-GCMencrypts every month and your plan.

PBKDF2-SHA256, 600,000 roundsturns your passphrase into a key.

Your device onlyis where your passphrase and keys are used.

ECDH P-256 + a matching codeshares a budget with your household.

Your keys

When you first sign in, you choose a passphrase. Dollarz then creates a random 256-bit data key on your device. Your passphrase is stretched with PBKDF2 (600,000 rounds of SHA-256) into a key that locks the data key. Only that locked copy is saved; the data key itself and your passphrase never leave your device.

You also get a one-time recovery key, 32 letters and numbers, which locks a second copy of the data key. If you forget your passphrase, it's the only way back in. We never see it.

Your budget

Each month and your overall plan are encrypted with AES-256-GCM using keys derived from your data key, before they're sent anywhere. Each encrypted document is tied to your account and its place in the database, so it can't be moved or swapped without being detected.

Even the names of your months are hidden: each one is stored under a code made from your key, so the database doesn't reveal which months you've budgeted.

What we store is scrambled data plus the locked copies of your key. Without your passphrase or recovery key, it's unreadable to us, to our hosting provider, and to anyone who might break in.

Sharing with your household

A shared budget has its own random budget key. Every member keeps their own copy, locked by their own data key, so nobody ever needs another person's passphrase.

Each person has a key pair (ECDH P-256). The private half is locked by their data key.
When you invite someone and they accept, both screens show an 8-digit code calculated from both people's public keys. Each device works it out on its own.
Only after you confirm the codes match does your device lock the budget key for them. If anyone had swapped a key in between, the codes wouldn't match.

Signing in

You sign in with Google or a one-time link sent to your email; there's no Dollarz password to steal. Signing in proves who you are; your passphrase is what unlocks the budget. Database rules let each person reach only their own data and the budgets they've been added to.

"Keep unlocked on this device" is optional. It stores your keys in your browser in a form that can't be copied out, and signing out removes them.

What we can see

Your email address and how you signed in (Google or email link).
The email addresses of the people you share a budget with, so we can show who has access.
When documents were saved, how many there are, and roughly how large they are.

We can't see your income, bills, balances, transactions, notes or anything else you enter.

Limits worth knowing

We can't reset a lost passphrase. If you lose both your passphrase and your recovery key, your budget can't be recovered by anyone.
The app is delivered from our servers. Like any web app, you trust that the code we send hasn't been tampered with. We serve it ourselves with a strict content security policy and no third-party scripts in the app, apart from Google's sign-in helper, which only loads while you sign in with Google.
Removing someone from a shared budget cuts off their access right away through our database rules; the budget's key isn't changed afterwards.
A downloaded backup is not encrypted. "Download my data" saves a readable file, so keep it somewhere safe.