Use mine
The add-on syncs with https://www.snippet-keeper.eu out of the box.
Install it, open Settings, turn on sync and you're done.
Keep the text you find on the web. Only you can read it.
Snippet Keeper is a Firefox add-on that saves selected text together with the page's URL, title and the time you saved it. Your snippets are stored in your browser.
Sync is optional: turn it on and they are encrypted in your browser before they go to the server, so the server stores them without being able to read them.
Firefox add-on coming soon
How it works
-
1
Save
Select text, then right-click and choose Save to Snippet Keeper, or press Alt+Shift+S. The snippet is stored in this browser.
-
2
Sync (optional)
You don't need it to save snippets. Turn on sync with a generated passphrase, then enter the same passphrase in another Firefox to get the same snippets there.
-
3
Browse
The popup shows your recent snippets. With sync on, Browse all opens a searchable page that decrypts them in your browser.
End-to-end encrypted
Without sync, nothing is sent anywhere. With sync, everything secret stays in your browser: the server only stores encrypted blobs and a few hashes, so whoever runs it, me included, can't read your snippets.
-
Your passphrase never leaves your browser
The add-on generates six random words from the EFF word list. From that passphrase it derives, with PBKDF2 (600,000 rounds) and HKDF, an account ID, an access key, a read-only key and an encryption key. Only the account ID and the two access keys are ever sent.
-
The encryption key is never sent
Each snippet's text, URL, title and save time are encrypted together with AES-256-GCM before upload. The server can't see which sites you saved from or when.
-
No account, no email, no password
There is nothing to sign up for. The server stores SHA-256 hashes of the access keys, not the keys themselves.
-
Keys in the browse link stay out of requests
The Browse all link carries its keys after the
#, a part of a URL browsers never send to the server, so they don't end up in server logs.
Good to know
- Your snippets live in the browser where you saved them. Stopping sync or deleting your account keeps them there; uninstalling the add-on removes them.
- Lose your passphrase and the copy on the server is gone. Nobody can recover it.
- The browse page runs JavaScript that the server sends. If you don't want to trust my server with that, run your own.
- Both projects are open source, so you can check all of this yourself.
Pick a server
Only needed if you turn on sync.
Run your own
The server is a small Laravel app (PHP 8.3 or newer). Host it anywhere with HTTPS, then enter its address in the add-on under Settings → Server before you turn on sync.
git clone https://pushin.eu/surfman/snippet-keeper-server.git
cd snippet-keeper-server
composer install --no-dev
cp .env.example .env
php artisan key:generate
php artisan migrate
npm install
npm run build
Set APP_URL in .env to your server's address
and point your web server at the public directory.
The API is documented in docs/api.md.