Architecture
NoteFlare is one Cloudflare Worker that serves a React app and a small JSON API, with a D1 database behind it. Encryption, decryption, offline storage, sync and merging all happen in the browser. The server stores and returns opaque blobs.
Your browser
React appservice worker caches it for offline
CryptoArgon2id, AES-GCM. Keys stay here
Sync enginequeue, three-way merge
IndexedDBciphertext + unsynced edits
ciphertext
over HTTPS
over HTTPS
Your Cloudflare account
Cloudflare Accesssign-in, MFA, sessions
Worker (Hono API)verifies the Access JWT, serves the app
D1 databaseciphertext and wrapped keys only
Cron triggerempties the trash after 30 days
Scripts, the CLI and the SDK use the same path through /api/v1 with a personal access token.
Tech stack
Section titled “Tech stack”| Part | Built with |
|---|---|
| Runtime | Cloudflare Workers with Static Assets and a Cron Trigger |
| Database | Cloudflare D1 (SQLite) |
| Sign-in | Cloudflare Access, verified with jose |
| API | Hono |
| UI | React 19, Tailwind CSS 4, shadcn/ui, lucide |
| Markdown | TanStack Markdown |
| Crypto | WebCrypto and hash-wasm (Argon2id) |
| Offline | A service worker for the app shell, IndexedDB via idb for encrypted notes and the sync queue |
Why Cloudflare Access instead of a password login
Section titled “Why Cloudflare Access instead of a password login”Access handles sign-in, MFA and sessions at Cloudflare’s edge for free, so the app ships no login code to get wrong. Your passphrase is a separate secret used only for encryption.
Full architecture notes on GitHubRepository map, request flow, the sync engine and the database schema.