IndexedDB

A browser offers several places to keep data. Cookies are tiny and travel to the server with each request. localStorage holds small strings and works synchronously, so heavy use can slow a page. IndexedDB is the one meant for real volume: it stores JavaScript objects, photographs, audio clips and other binary data, supports indexes for fast lookups and transactions that either complete or leave nothing half written, and runs in the background so the page stays responsive. Reads and writes return promises or fire events instead of blocking, which suits big imports and long lists. Libraries such as Dexie make its programming interface easier to use. Typical uses are offline mail clients, note-taking tools, map tiles, game saves and drawing apps.

Storage is tied to the site's origin, so another site cannot read it. That is not the same as secret. By default the data is not encrypted: anyone with access to the browser profile on the device, or any script that runs on the same site, can read it. The quota is shared by everything a site stores and varies with the browser and the free disk space. Private browsing windows typically erase everything when closed, and some browsers cap how much a site may write. The browser may also remove it, for example when you clear site data or when disk space runs low and the site has not asked for persistent storage.

That is why serious local apps add their own protection. The Web Crypto API lets a page generate a key and mark it non-extractable, which means the page can encrypt and decrypt with it but no script can read its bytes. Content is encrypted before it is written to IndexedDB and decrypted only to be displayed; sealing each record separately keeps one corrupted entry from spoiling the rest. This protects against someone copying the files from a lost laptop, though not against malicious code that runs inside the page itself, which is why a strict security policy on the site matters too.

Everything you create on NeverNo lives in an IndexedDB database called neverno, in this browser only: conversations, messages, folders, images, videos and sounds, characters you create, memory and the documents of your private vault. On first use, the browser creates a non-extractable AES-256-GCM key, which stays in the keys table of the same database and never leaves the device. Each piece of content is encrypted on its own, with a random vector, so there is no single file to open. Opening the Application tab of the developer tools shows the database and its tables, with the sealed fields appearing as unreadable ciphertext.

A few markers stay readable so that conversations can be sorted and found without decrypting everything: ids, dates and the model used. An ephemeral chat is never written to the database at all. Erasing everything in Settings, or clearing the site's data, deletes the database and the key. Qwen 3.5 35B from Alibaba, free on NeverNo, reads images and lets you choose whether it reasons; its replies reach your browser, where your history is encrypted and stored.