How device pairing works — and why the relay never sees your data

Linkman syncs across your devices through a relay — but that relay is deliberately dumb. It's a content-blind store-and-forward pipe: it only ever holds opaque ciphertext keyed by anonymous IDs. It never sees your links, your titles, or your keys.

So how does a brand-new device get in without trusting the relay?

What you do

• On a device that already has your links, open Devices → Add a device and Generate pairing code.
• On the new device, choose Pair this device and enter that code.
• Both screens now show the same verification number. If they match, tap Codes match — pair. If they don't, tap Don't match — someone may be intercepting.

Why comparing a number is enough

When the two devices connect, they run an ephemeral X25519 key exchange (ECDH) to derive a shared secret that only they know. The verification number is computed from that secret on both sides.

A man-in-the-middle would have to sit between them — and would end up with a different shared secret, which produces a different number. So if the digits on both screens match, you know the channel is direct and private. That's the whole point of checking them.

Once you approve, your master key is sealed to the new device over that verified channel. The relay just forwards the bytes; it can't unseal them. From then on, edits flow between your devices as conflict-free encrypted changes.