The philosophy behind Filarr

Local-first: your files live on your disk first.

Your files live on your disk. Not on a remote server with an app-window bolted on top. That’s an architecture difference, not a marketing one — and it changes everything.

01 — The context

How we ended up cloud-first

For fifteen years the SaaS industry converged on one model: your data sits on their servers, you pay a subscription to reach it, and your app is a window onto it. It works because it’s profitable and easy to deploy. But you pay in dependency: no network, no subscription, no goodwill from the vendor — and your data isn’t yours anymore.

The hidden cost of cloud-first

  • Offline = degraded or blocked
  • Service shuts down = export-before-extinction scramble
  • Latency = depends on the network, not on your disk
  • Access = account and subscription required
  • Trust = the provider can read your data

02 — The manifesto

The local-first manifesto (Ink & Switch, 2019)

In 2019 researchers at Ink & Switch (Martin Kleppmann, Adam Wiggins, Peter van Hardenberg, Mark McGranaghan) named the counter-proposal. Seven principles. Here they are, applied to encrypted storage.

  • 1. Speed of your local disk

    The app reads and writes on your machine. No network request to open a file.

  • 2. Works across devices

    Sync is a property of the system, not a master server. Devices sync when they can, diverge when they can’t.

  • 3. The network is optional

    Offline isn’t a degraded mode. It’s the default mode — the network is a bonus.

  • 4. Asynchronous collaboration

    Several people can edit the same file without a central arbiter. Conflicts merge locally.

  • 5. Longevity

    Your data outlives the software. An open format, a readable folder, an exportable key — your files follow you even if the app disappears.

  • 6. Privacy and security by default

    Data is encrypted on the device, and the server only stores what it cannot read, except databases you entrust to the hosted black box (an option). Encryption is built-in, not an add-on.

  • 7. Full ownership and control

    You own your data, not just a license to access it. You can export, version, move it without asking permission.

Read the original manifesto: Ink & Switch — “Local-first software: you own your data, in spite of the cloud”.

03 — Examples

Apps you already use made this choice

Local-first isn’t a fringe idea. Several respected tools apply it, each in their domain.

Linear

Linear keeps an aggressive local cache. You can create and edit issues offline; sync happens when you’re back online. That’s why the app feels so fast.

Issue tracking

Obsidian

Your notes are .md files in a folder you choose. The app just reads and displays them. No account, no mandatory cloud.

Markdown notes

Muse

Muse stores your boards locally and syncs optionally over iCloud. The pioneer model of local-first, from Ink & Switch themselves.

Thinking canvas

Filarr adds one specific combination to this landscape: rich notes, encrypted files, and a graph that connects both — local-first by default.

04 — In Filarr

How Filarr applies these principles

Filarr invents nothing new in substance: it applies seven well-known principles to encrypted notes and files. The difference is that it’s the default, not a premium option.

  • A real folder on your disk

    Filarr stores its data in a local folder you can copy, back up, version with your usual tools. No remote database to query.

  • Encrypted on your device, before anything leaves

    Each file is encrypted on your device, using AES-256-GCM, under your account key (the FEK), with a fresh random value for each one. The FEK is randomly generated and wrapped by a key derived from your password (PBKDF2-SHA-512, 600,000 iterations). Our servers only store encrypted data and the encrypted copy of the key.

  • 100% offline by default

    The app starts, reads, writes, edits without a connection. There’s no “degraded” offline mode: that is the main mode.

  • Cloud sync is a service, not a pillar

    You turn sync on if you want multi-device access. Otherwise Filarr works for a lifetime, free, without an account.

Common questions

Is local-first just another word for “offline-first”?
No. Offline-first means the app works without a network. Local-first adds: your files belong to you, they’re ownable, exportable, and outlive the software. It’s a superset of offline-first.
If everything is local, how do I sync between devices?
With cloud sync, which is optional: your files are encrypted on your device with AES-256-GCM, then sent encrypted to Cloudflare R2, in Cloudflare’s Western Europe region. Your other devices download and decrypt them. Our servers only store encrypted data they cannot read.
What if Filarr goes away?
Your files stay on your disk, encrypted. You have your recovery key (exportable from Settings > Security). You can open, read, recover your data without going through our servers. That’s the difference between local-first and cloud-first: in the latter, service shutdown = end of access.
Can I really use Filarr without an account?
Yes. The local core (notes, files, graph, canvas, encryption, multi-profile) is free and works without any account. An account is only required if you turn on cross-device cloud sync.
What’s the difference with an encrypted cloud like Filen or Proton Drive?
Encrypted clouds store your files on their servers, encrypted client-side. Their desktop app is a window onto that cloud — uninstall it and your files stay with them. Filarr stores your files locally, encrypted. Uninstall Filarr: your files are still on your disk. Cloud sync is additive, not a replacement.

Local-first is easy to try.

Download Filarr, use it offline, and look at where your files are. Free and without an account, on Windows and Linux; Mac coming soon.

Download Filarr