The philosophy behind Filarr
Local first. Cloud if needed.
Your files live on your disk. Not on a remote server with an app-window bolted on top. That’s an architecture difference, not a marketing one — and it changes everything.
How we ended up cloud-first
For fifteen years the SaaS industry converged on one model: your data sits on their servers, you pay a subscription to reach it, and your app is a window onto it. It works because it’s profitable and easy to deploy. But you pay in dependency: no network, no subscription, no goodwill from the vendor — and your data isn’t yours anymore.
The hidden cost of cloud-first
- Offline = degraded or blocked
- Service shuts down = export-before-extinction scramble
- Latency = depends on the network, not on your disk
- Access = account and subscription required
- Trust = the provider can read your data
The local-first manifesto (Ink & Switch, 2019)
In 2019 researchers at Ink & Switch (Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, Mark McGranaghan) named the counter-proposal. Seven principles. Here they are, applied to encrypted storage.
1. Speed of your local disk
The app reads and writes on your machine. No network request to open a file.
2. Works across devices
Sync is a property of the system, not a master server. Devices sync when they can, diverge when they can’t.
3. The network is optional
Offline isn’t a degraded mode. It’s the default mode — the network is a bonus.
4. Asynchronous collaboration
Several people can edit the same file without a central arbiter. Conflicts merge locally.
5. Longevity
Your data outlives the software. An open format, a readable folder, an exportable key — your files follow you even if the app disappears.
6. Privacy and security by default
Nobody reads your data, not even the software vendor. Encryption is built-in, not an add-on.
7. Full ownership and control
You own your data, not just a license to access it. You can export, version, move it without asking permission.
Read the original manifesto: Ink & Switch — “Local-first software: you own your data, in spite of the cloud”.
Apps you already use made this choice
Local-first isn’t a fringe idea. Several respected tools apply it, each in their domain.
Issue tracking
Linear
Linear keeps an aggressive local cache. You can create and edit issues offline; sync happens when you’re back online. That’s why the app feels so fast.
Markdown notes
Obsidian
Your notes are .md files in a folder you choose. The app just reads and displays them. No account, no mandatory cloud.
Thinking canvas
Muse
Muse stores your boards locally and syncs optionally over iCloud. The pioneer model of local-first, from Ink & Switch themselves.
Filarr adds one specific combination to this landscape: rich notes, encrypted files, and a graph that connects both — local-first by default.
How Filarr applies these principles
Filarr invents nothing new in substance: it applies seven well-known principles to encrypted notes and files. The difference is that it’s the default, not a premium option.
A real folder on your disk
Filarr stores its data in a local folder you can copy, back up, version with your usual tools. No remote database to query.
Your password never leaves your machine
A master key derived from your password (PBKDF2, 600,000 iterations) encrypts per-file keys (FEKs). Everything happens client-side — the server only sees unreadable blobs.
100% offline by default
The app starts, reads, writes, edits without a connection. There’s no “degraded” offline mode: that is the main mode.
Cloud sync is a service, not a pillar
You turn sync on if you want multi-device access. Otherwise Filarr works for a lifetime, free, without an account.
Common questions
Is local-first just another word for “offline-first”?
No. Offline-first means the app works without a network. Local-first adds: your files belong to you, they’re ownable, exportable, and outlive the software. It’s a superset of offline-first.
If everything is local, how do I sync between devices?
Via optional cloud sync: your files are encrypted locally with AES-256-GCM, then encrypted blobs are pushed to Cloudflare R2 (EU). Your devices download the blobs and decrypt them with the key they already share. The server never sees plaintext.
What if Filarr goes away?
Your files stay on your disk, encrypted. You have your recovery key (exportable from Settings > Security). You can open, read, recover your data without going through our servers. That’s the difference between local-first and cloud-first: in the latter, service shutdown = end of access.
Can I really use Filarr without an account?
Yes. The local core (notes, files, graph, canvas, encryption, multi-profile) is free and works without any account. An account is only required if you turn on cross-device cloud sync.
What’s the difference with an encrypted cloud like Filen or Proton Drive?
Encrypted clouds store your files on their servers, encrypted client-side. Their desktop app is a window onto that cloud — uninstall it and your files stay with them. Filarr stores your files locally, encrypted. Uninstall Filarr: your files are still on your disk. Cloud sync is additive, not a replacement.
Local-first is easy to try.
Download Filarr. Use it offline. Look at where your files are. That’s it. Free, no account, Windows and Linux (Mac coming soon).