--- title: Technology: how Relic works description: How Relic works: a local-first SQLite/FTS5 search index that runs on your device, on-device ML for tagging and OCR, Argon2id + XChaCha20-Poly1305 end-to-end encryption, and conflict-free per-relic sync. canonical: https://relic.space/technology source: https://relic.space/llms.txt --- [Relic](https://relic.space/)OPEN SOURCE [Sign in](https://relic.space/signin)[Get Relic free](https://relic.space/#download) Under the hood # The technology behind Relic. A clipboard that remembers everything is only useful if it's fast, private, and the same on every device. Relic gets there with three ideas: search runs locally over your own data, the intelligence that organizes it runs on your device, and everything the server stores is encrypted with a key only you hold. XChaCha20-Poly1305authenticated cipher Argon2idkey derivation SQLite FTS5local search index 0plaintext on the server Architecture ## Two layers, deliberately separate. Every device keeps a decrypted SQLite index for instant, offline search. The cloud keeps only encrypted objects. Each device syncs ciphertext down, decrypts it locally, and searches over plaintext it never uploads, so the server never sees a thing. On your devices plaintext, on-device only iPhone · Android local index · decrypted Mac · Windows · Linux local index · decrypted encrypted ↑ ↓ ciphertext only Sync store Cloudflare, or self-host on any S3/HTTP store ciphertext + wrapped key Search ## Fast, local, and it gets your meaning. Type a word, a fragment, or a vague description and Relic searches your own local index, so results are instant and work offline. A full-text engine handles exact terms, and on-device embeddings find the right relic by meaning, so a vague description lands on it too. Keyword ### SQLite FTS5 A local full-text index ranked by bm25, with prefix, boolean and phrase queries. Instant at 100k+ rows, and it works offline. Meaning ### Semantic search On-device embeddings find a relic by what it meant, not the exact words you copied, so “that payment error screenshot” lands even when you don’t remember the text. On-device intelligence ## The AI that sorts it runs on your machine. A bundled Rust engine (`sift`) does the understanding out-of-process, so capture and typing never stall. Models download once (\~220 MB) and run locally, so nothing you copy is ever sent to a cloud model. ### Stage A: deterministic Instant, no models: regex and heuristics tag every copy by subtype, such as url, code, secret, email, json, path, color. ### Stage B: reads images OCR pulls text out of screenshots; a captioning model writes a short description, so an image becomes searchable text. ### Stage C: embeds for meaning An on-device model turns each relic into a vector, so search understands what you meant, not just the words you typed. Runs entirely on your device. No cloud AI, ever. Encryption ## Encrypted to the device, not to a promise. A random 256-bit master key encrypts everything. Your passphrase derives a key (via Argon2id) that _wraps_ the master key; the server only ever stores the wrapped key and a salt, useless without the passphrase it never sees. Each ciphertext is bound to its own item id, so nothing can be swapped or mixed server-side. Your passphrase chosen at setup · never leaves the device Argon2id derives a key-encryption key (KEK) 256-bit master key random, wrapped under the KEK Your relics sealed with XChaCha20-Poly1305 random nonce per encryptionAAD bound to each uidpassphrase change = re-wrap, no re-encryptionrecovery kit holds the raw key: you keep it, we never do What the server can see Ciphertext and the wrapped master key Your account email and timestamps Approximate sizes, item and device counts Which items you promoted, and your tier What it can never see Your content: text, images, files Titles, notes and tags The master key or your passphrase Anything readable, even under breach or subpoena File syncing ## Copy here, paste there, conflict-free. Sync is built on independent, encrypted objects rather than one shared file, so it stays correct no matter how many devices write at once and never needs a merge step. Capture on iPhone encrypt → PUT uid Sync store ciphertext only Paste on laptop pull → decrypt ### Per-relic objects Each copy is an independent object keyed by a stable id. Updates are plain PUTs with no read-modify-write, so two devices never clobber each other. Conflicts resolve last-writer-wins per item, which is harmless. ### Incremental by cursor Devices sync down by an updated-at cursor. A fresh device pages the archive once, then only ever pulls what changed. ### Tombstones for deletes A delete leaves a small marker for 30 days, so an offline device learns about it on the next sync instead of resurrecting the item. ### Blobs, fetched on demand Images and files are encrypted blobs stored separately and pulled only when you open them, so large items never slow down text sync. How we earn trust ## Verifiable, not just trustworthy. End-to-end encryption only matters if you can check the code that holds your key. Relic's encryption is open source, and its sync server is too, so you can read the crypto, run it, and host the server yourself. You do not have to take our word for any of it. The encryption that holds your key is open source (relic\_crypto), so you can read and run it The entire sync server is open source and self-hostable, so you can run it on your own hardware No analytics or crash SDKs that could carry plaintext No key escrow, no server-side decryption, and no server-side recovery path [relic\_crypto · Apache-2.0](https://github.com/RelicSync/relic/tree/main/crypto)[sync server · AGPL-3.0](https://github.com/RelicSync/relic/tree/main/selfhost)[self-host guide](https://relic.space/self-host) Built with Rust coreSQLite · FTS5XChaCha20-Poly1305Argon2idzeroizesift · ONNXEmbeddingGemmaFlorence-2FlutterCloudflare ## Stop losing what you copy. Works on all your devices · Only you can read it · Free to start [Get Relic free](https://relic.space/#download)[Read the technology](https://relic.space/technology) Windows, Mac, Linux, Android & iPhone · locked end-to-end