# Sealist

> End-to-end encryption for Todoist

Canonical page: [https://chrome-stats.com/d/sealist](https://chrome-stats.com/d/sealist)

## Overview

- **ID:** `sealist`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** yaspltbr
- **Category:** privacy-security
- **Daily users:** 1
- **Weekly downloads:** 1
- **Rating:** 5.00 / 5 (2 ratings)
- **Version:** 1.0.3
- **Last updated:** 2026-06-22
- **First published:** 2026-06-19
- **Size:** 322 KB
- **Data as of:** 2026-09-08
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/sealist/)
- **Website:** [https://gitlab.com/yaspltbr/sealist](https://gitlab.com/yaspltbr/sealist)

## Description

Sealist 🦭

A browser extension offering seamless E2E encryption for Todoist.
Basically, this cutie seals your tasks and comments only for you to see.

Background

What Todoist Already Does

See <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/cc2c621bae15122f25b491fb70a3b04585753761e1ea7c6d39dd33403588c51e/https%3A//www.todoist.com/security" rel="nofollow">Todoist Security Policy</a>.
<ul><li>All user data is encrypted <strong>at rest</strong> in their production database.</li><li>Encryption is keyed by a master key <strong>held by Todoist</strong>.</li></ul>
It stops the stolen-hard-drive attack. What it doesn't stop:
<ul><li>Master key compromise or misuse.</li><li>A court order or legal compulsion.</li><li>A breach of the live app stack - prod read access means plaintext access,
  employee or attacker alike.</li><li>A future policy change on who gets to read your content.</li><li>Cross-border data-sharing pressures.</li></ul>
The Goal

Move the trust boundary off Todoist's server and onto the user's browser.
Encrypt before task leaves, decrypt on the way back. Todoist's servers see
opaque ciphertext. Plaintext only ever exists inside the browser client while
the extension is <strong>Unsealed</strong>.

We want to provide a similar model to Mailvelope/FlowCrypt which layer PGP onto
Gmail, but without requiring users setting PGP keys.

We should not make Todoist <em>that much</em> worse to use :p. The crypto should be
conservative and audited. The codebase must be small enough to read. The
shortcomings must be documented honestly.

Non Goals

We are not trying to defeat:
<ul><li>Malware running on the user's machine with arbitrary access (extension memory,
  screenshots, key loggers).</li><li>A malicious extension installed by the user with the same <code>host_permissions</code>
  reading our injected DOM. Extensions are isolated from <em>each other's</em>
  in-memory state and storage, but not from a malicious extension reading the
  page we both render to.</li><li>A user picking a low-entropy password. We gate on password complexity and
  employ a memory-hard KDF to make the offline attack as expensive as we
  honestly can, but a determined adversary wins against low-entropy passwords if
  one would pass the checks.</li></ul>

License

Copyright (C) 2026 yaspltbr

This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by the Free Software
Foundation, either version 3 of the License, or (at your option) any later
version.

IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

## Rankings

- #72,996 — Overall
- #37 — todoist
- #37 — todoist.

## Permissions and access

### Permissions

- `storage`
- `https://app.todoist.com/*`
- `https://api.todoist.com/*`

### Content script matches

- `app.todoist.com`

## Safety

- **Risk impact:** Low risk impact
- **Risk likelihood:** Moderate risk likelihood

### Analysis details

- Injects scripts into web pages, which may alter or extract site contents, resulting in a substantial risk.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [SeeOnce Privacy](https://chrome-stats.com/d/seeonce-privacy) — 1 users, 5.00 / 5
- [Crypto Sender](https://chrome-stats.com/d/crypto-sender) — 5.00 / 5
- [Locki](https://chrome-stats.com/d/locki) — 1 users, 5.00 / 5
- [NSS Communicator](https://chrome-stats.com/d/nss-communicator) — 1 users
- [Seif Pro QR Login](https://chrome-stats.com/d/seif-pro-qr-login) — 1 users
- [Private Notes](https://chrome-stats.com/d/private_notes) — 143 users, 4.68 / 5
- [Locker - Password Manager](https://chrome-stats.com/d/locker-password-manager) — 33 users, 4.90 / 5
- [TodoMaster](https://chrome-stats.com/d/todomaster) — 2 users, 5.00 / 5
- [Encryption Tool](https://chrome-stats.com/d/text-encryption-tool) — 92 users, 4.43 / 5
- [Secret Bookmarks](https://chrome-stats.com/d/secret-bookmarks-1) — 114 users, 5.00 / 5
- [SecureSend - Secure Secret Sharing](https://chrome-stats.com/d/securesend)
- [TaskDrift](https://chrome-stats.com/d/to-do-list-xtension) — 5 users

---

Source: [Chrome-Stats](https://chrome-stats.com/d/sealist)