What it does

Bookmarks are a surprisingly revealing set of data. They say what you read, what you are researching, what you are worried about and what you are planning. In a normal browser they sit in a system you do not control, synced through a service that can read them, and they are locked to one vendor – Safari does not sync to Chrome, Chrome does not sync to Firefox.

Whispermarks treats them the way a password manager treats passwords. Titles, URLs, notes, tags and favicons are encrypted on your device with AES-256-GCM before anything is sent. What reaches the server is a blob it cannot read, and the key is a twelve-word recovery phrase that never leaves your machine. Even with full access to the database, an attacker gets ciphertext.

You can keep personal and work bookmarks in separate encrypted vaults and open both at once. Saving takes one click – the current page, a link, or every open tab – and anything unfiled lands in an Unsorted inbox rather than demanding a folder up front. Sync between devices is incremental, and everything works offline against a local cache.

How it was built

Zero-knowledge is easy to claim and awkward to build, because it removes the server’s ability to help with anything. It cannot index your bookmarks, cannot merge two conflicting versions of a record, and cannot give you your data back if you lose your key. Every one of those problems has to be solved on the device instead.

The recovery phrase shows the shape of it most clearly. There is no password reset, because a reset would mean the server could re-issue access to data it is not supposed to be able to read. Twelve words are the only key, and losing them means losing the vault. That is the honest cost of the guarantee, and it is better stated plainly than buried in a FAQ.

The one thing the server does hold is your email address, used for magic-link sign-in and for routing encrypted blobs to the right account. It sits in a separate encryption domain from the bookmark content and is never connected to it. Beyond that the server knows how many blobs you have and when they last changed. Nothing else.

One use case it turned out to fit neatly: private browsing. In Tor, Brave or an incognito window your bookmarks vanish with the session, which is the point, but it means starting from nothing each time. Whispermarks sits outside the browser – unlock the vault, open a bookmark, browse, close everything. The bookmarks persist and the history does not.

Status

Public preview, and free. You can create an account and vaults and use the browser extensions today. No credit card, no account form – sign-in is a magic link.

Platforms

Web, plus extensions for Chrome, Edge and Firefox.

---

Need support? Visit our support page, or see the portfolio.