Encrypted Tags: Tag Your Files Privately

Today we shipped encrypted tags. You can add tags to files and folders in Ellipticc Drive, create custom labels, pick colors, and use advanced tag search, and keep tag content private. It is simple to use and feels like normal tagging, but private.

How it works

• You create and edit tags right in your browser. We encrypt them locally so the server never sees the tag text.
• The server stores only encrypted blobs and the smallest metadata needed to deliver tags to your devices.
• Searches and filters run on your device when possible, so your tags stay private.

What this means for you

• Organize files using custom tags and colors without exposing tag text.
• Advanced searches (multi-tag, AND/OR filters, quick suggestions) run locally and show you matches without sending tag text to the server.
• Tags are private and tied to your account. We cannot read them unless you choose to share.

Quick usage

1. Hover an item and click the three-dots icon, then choose “Details”.
2. In the sheet modal, use the ”# Add tags” field to type labels and pick colors.
3. Save. The tag is encrypted locally and uploaded as an encrypted blob.
4. Use the search bar or tag filter to find items by tag.

For crypto nerds

The tagging system uses the Zero-Knowledge Filename/Tag Encryption scheme defined in our crypto library. To be precise:

• Encryption (XChaCha20-Poly1305): Tag names are encrypted using XChaCha20-Poly1305 for authenticated encryption. Each tag blob includes a randomly generated nonce so the client can decrypt later.

• Key derivation (HMAC-SHA256): We derive a unique key for each tag with an HKDF-like HMAC-SHA256 construction. In simple terms:

  DerivedKey = HMAC-SHA256(MasterKey, Salt + “filename-key”)

  The salt is random 32 bytes per tag, and the MasterKey is a 32-byte secret stored client-side.

• Result: Each tag is encrypted with a unique, entry-specific key, ensuring isolation and zero-knowledge privacy. Plain tag text never leaves your device.

We do keep tiny metadata to manage delivery and indexing, which can include tag counts. So yes, we can tell if you tagged the same image 219 times. Congratulations.