Backup: the .midden file

Settings → Backup → export puts everything you made into one .midden file:

• your items, files, tags, captures and map positions;
• what you've said about them: reminders, the trash, markdown and ticked boxes, bundles;
• the hoard's items, still encrypted by the hoard;
• your identity, so a restore keeps it.

import merges a .midden file in. Nothing already here is replaced or duplicated.

Encrypted, by default

Exporting asks for a passphrase for that file. You type it twice, and it must pass the same strength check as the hoard's and sync's, because the file may sit in a cloud folder or on a USB stick for years. It's its own passphrase: nothing ties it to your sync passphrase.

How it's sealed:

• The key: Argon2id turns the passphrase into the key, with a new salt for each file.
• The encryption: AES-256-GCM, in 1 MB chunks, so a large backup never needs one giant encryption.
• Tamper evidence: each chunk's associated data is the file's header, the chunk's place, and whether it's the last. A file that's edited, reordered or cut short doesn't open, and midden says so instead of importing part of it.
• Hostile key settings: the header's Argon2id settings must lie within midden's floor and ceiling, so a file can't make the passphrase cheap to crack, or ask for gigabytes of memory.

What stays visible: the file's size, and that it's a midden backup.

A forgotten passphrase loses that file, not your midden. midden keeps no copy, and there's no recovery sheet for backups.

Importing one

1. The passphrase: an encrypted file asks for its passphrase before anything else. A wrong one says it wants the passphrase from when you exported, which may not be your sync passphrase.
2. What it adds: midden says what the file adds before importing it, and, if sync is on, that the new items go to your Drive and to all your devices.
3. Your identity: an encrypted backup carries your identity.
   • On a fresh install, it comes back, so your contacts still recognise you.
   • On a browser that already made its own, midden asks. Keeping this browser's is the default. If you choose the backup's, this browser's keys retire, as when sync settles two, so what was sent to its card still opens for a while.

A plain file, on purpose

export a plain file instead writes the archive unencrypted, a zip you can open with other tools:

• Readable by anyone who has it: items, files, tags, captures, reminders and the text read from your pictures. Only the hoard's items stay locked.
• Never in it: your identity's private keys. Restoring from a plain file means a new identity, and your contacts would need to add you again.
• On import: a plain file never brings an identity, even one crafted to hold one.

Older plain backups import as before.