Your open tabs say more about you than your search history. They show what you're deciding, who you're hiring, what you can't afford, what you're worried about. A tool that saves all of that has to earn a lot of trust. Our answer is to design so we need as little of that trust as possible: UNIHODL is local-first by default. Here's what that actually means, concretely.
Local-first, not cloud-first
Most tools send your data to a server first and let you use it second. We flipped that. When you save a session, the capture is written on your device. It works with no account and no network. The cloud is opt-in, not the default path.
That single decision changes the threat model. If your context never has to leave your machine to be useful, then most of the ways it could leak simply don't exist.
On-device AI tagging
When UNIHODL labels what you were doing — video, article, code, product, the intent behind a session — that labeling runs on your device, using the browser's built-in on-device model. Your page content isn't shipped to a server to be classified. The smart part happens locally.
Sync is end-to-end encrypted
If you do turn on cross-device sync, here's the honest description of what we can and can't see:
- Your passphrase derives a key on your device using PBKDF2-SHA256 (600,000 iterations).
- That key encrypts each session with AES-GCM-256 before anything is uploaded.
- We store ciphertext. We never receive your passphrase or your key.
So sync gives you your sessions on every device, and we hold an encrypted blob we can't read. That's the point. (The full security writeup is here.)
What this means for you
- No account needed to capture and resume. (Install and try it.)
- The AI never sends your page content to a server.
- Turn on sync and we still can't read your sessions.
- A full breakdown of our security posture lives on the security page.
Trust is easier to give to a tool that designed itself to need less of it.