H

Haven

Set a passphrase. This encrypts everything on this device. We never see it. Next you'll get a one-time recovery code as a backup if you forget it.

Passphrase

Confirm passphrase

At least 10 characters. Longer and less guessable beats complex; four random words work well.

Read the security model

Save this recovery code. We never see it. If you lose both your passphrase and this code, your data cannot be recovered by anyone, not even us.

I've saved this recovery code somewhere safe

Your tasks are encrypted and stored locally. Enter your passphrase to unlock your vault.

Passphrase

Enter your recovery code to regain access and set a new passphrase.

Recovery code

Enter shares one at a time from the people you trusted with them. Once enough are in, they'll be combined into your recovery code automatically. The individual shares are never enough on their own.

Share

Recovery code accepted. Set a new passphrase. Your existing tasks stay exactly as they are, only the passphrase changes.

New passphrase

Confirm new passphrase

H

/

You're offline — everything here still works. Changes save locally and sync once you're back.

0 selected

To Do

0

In Progress

0

Done

0

Task Status Priority Due

Watch encryption happen

Type a task title below. Nothing here is saved. This runs the exact same encryption function every real task on your board goes through, live, so you can see it with your own eyes instead of taking our word for it.

What's in your browser's memory

What a server would ever see

How your data is protected

Every task is encrypted on this device with AES-256-GCM before it ever touches storage. The key that does that encryption is derived from your passphrase and never leaves your browser. It's never sent anywhere, not to us, not to a server, not to anyone. IndexedDB, this browser's local database, holds only what you see below: an ID, a random IV, ciphertext, and a timestamp. If sync is ever turned on, that's also the only thing that would ever be sent: the exact same ciphertext already sitting here.

Verify your task history

Every time a task is added, edited, or deleted, Haven signs a record of it with a key that lives only on this device and chains it to the record before it, like a private, personal git log. If anything in that log were ever silently altered, this check would catch it: a broken link in the chain, or a signature that doesn't match, shows up immediately below. This runs entirely on your device against your local history. Nothing is uploaded to check it.

Insights

Computed instantly from the tasks already decrypted in your browser's memory. Nothing here is tracked over time, logged, or sent anywhere. Close the tab and it's gone; reopen it and it's recomputed fresh from what's actually on your board right now.

By status

By priority

By project

Top tags

Shows every task with a due date, across all your projects. Exporting gives you a standard .ics file to import into Google Calendar, Apple Calendar, or Outlook, a one-time copy, not a live sync back to Haven.

Notes

Encrypted the same way tasks are — free-form writing for anything that doesn't fit a task: an appointment's details, a reference number, a longer thought. Local-only, not part of sync yet.

AI assistant

A small language model that runs entirely in your browser. It never sends a task, a title, or a note anywhere. Off by default: nothing downloads until you click Enable below. The download (about 360MB, once) does need the internet and takes a few minutes; after that, generating an answer is a local computation with zero network requests, even offline, usually under a minute. It's genuinely small, so answers are useful but plain-spoken rather than polished. It can also propose adding or deleting a task from plain-language instructions — it only ever proposes the change; nothing happens until you confirm it.

Starting…

What should I focus on today?

Looks at your open tasks and suggests where to start.

What did I get done this week?

A short recap of what you completed in the last 7 days.

Break a task into subtasks

Pick a task; review suggestions before adding any.

Ask anything

Type your own question. It sees the same open-task list as "focus on today."

Add or delete a task

Tell it what to do. It proposes the change; nothing happens until you confirm.

Nothing here yet

Type a task above and press Enter to get started, or

No matching tasks

Try a different search term.

Edit task

Title

Project

Notes

Status

Priority

Due date

Repeat

Share this task

A link that lets anyone with it view this task, without an account. It's encrypted with a fresh key that only ever lives in the link itself. The server relaying it never sees that key, so it can't read the task either.

Link expires after

Views allowed

What to share

Title Notes Status Priority Due date Tags Subtasks

Each field you leave checked gets its own key in the link. Uncheck one and its ciphertext never even leaves your device — not "encrypted but shared," genuinely not sent.

Share link

Scan with another device to open this link directly.

Dead-man's switch

Publish something that stays genuinely unreadable, to anyone including you, until a real time-lock puzzle finishes solving — not a countdown a server enforces, actual sequential computation with no shortcut. Cancel it anytime before then; if you don't, anyone holding the link can watch it unlock live.

Title

Content to disclose

Unlocks after

Link expires after

Honest limit: the wait above requires someone's browser tab actually running that whole time (yours, to solve it early is impossible by design; a visitor's, once it's time). There's no way to schedule a genuine multi-day disclosure without a tab open that long — see the security page for why.

Dead-man's switch link

Scan with another device to open this link directly.

Share this now. As long as you cancel it before it unlocks, nobody sees the content.

Your active switches

Vault security checklist

A plain read of what's actually configured on this vault right now — not a score, and nothing here is inferred or assumed.

Add task

Title

Project

Notes

Status

Priority

Due date

Repeat

What's in your browser's memory

What a server would ever see

Social recovery

Split your recovery code into pieces you give to people you trust. Any of them, working together (enough to reach the threshold you choose) can help you back in if you ever forget your passphrase and lose the code. Nobody, not even you, can read the pieces alone or reconstruct anything to give it to anyone else.

Your existing recovery code

Shares needed to recover

Total shares to create

Give each share below to a different person, over a different channel if possible (one by text, one in person, one by email), and copy each one individually. Once you close this, these exact shares won't be shown again; generate a new set instead if you lose track of one.

Unlock with a passkey

Add a passkey (Touch ID, Windows Hello, or a hardware security key) as a faster way to unlock. Your passphrase still works too, and still is what protects the actual encryption key underneath. Needs an authenticator that supports resident keys and encrypted storage (most modern platform authenticators do); if yours doesn't, you'll get a clear error and nothing will be changed.

Confirm your passphrase

Passkey added. You can use it next time you unlock, from this device.

Set up a decoy vault

Pick a second passphrase. Entering it on the lock screen opens a completely separate, normal-looking vault instead of this one. Nothing in the app shows which one is open, so it's worth adding a few plausible tasks to the decoy so it holds up to a glance.

Decoy passphrase

Confirm decoy passphrase

Use a different passphrase than your real one. This doesn't sync to other devices and has no recovery code. Lose this passphrase and the decoy vault's contents are gone for good, the same as losing both your real passphrase and recovery code would be for this vault. Running this again replaces the decoy vault entirely, including anything already in it.

Automation rules

Runs entirely on your device, checked whenever the board updates. Nothing is ever sent anywhere to evaluate a rule. Rules don't trigger other rules (no chains), so there's no way for one to set off an endless loop of another.

When

Tag (only used for "created with a tag")

Then

Value

New note

Title

Note 0 / 20000

Tags (optional)

New from template

Adds a starter set of tasks to a project. Each one is created exactly like typing it by hand, so it's encrypted, shows up in history, and triggers automation rules the same as any other task.

Template

Project name

Sync (optional)

Sync keeps tasks in step across your devices through a server that only ever stores ciphertext, the same guarantee as this device, nothing new to trust. Leave the token blank to start a fresh, empty bucket, or paste one from a device you've already set up to join it.

Sync server URL

Sync token

Joining an existing bucket needs the recovery code from the device that started it. That's what lets this device decrypt the same tasks, not the token alone. Your passphrase on this device doesn't change; confirming it just re-locks the shared key under it.

Recovery code (from the other device)

Confirm your current passphrase

Sync is on. This token is a bearer capability for your ciphertext bucket, so anyone who has it can read and write it: treat it like a password. Enter this same server and token on another device, along with your recovery code, to sync between them. Your recovery code now unlocks this synced task list on any joined device, not just this one, so it's worth treating with the same care.

Server

Sync token

Pair a device

Connects directly to another device over WebRTC and exchanges tasks peer-to-peer — your tasks never touch a server either way. A quick code uses Haven's relay only to set up the connection (it sees network details, never tasks); pairing fully offline skips that too.

Enter this code on the other device, or scan it:

Enter the code from the other device

Paste the code from the other device