Claude Code sessions should be encrypted

Claude Code is exploding in popularity right now, and people are using it for much more than writing code.

Everyone should be using Claude Code more

PMs, marketers, designers, founders, parents. Everyone.

The trick is to forget that it’s called Claude Code and instead think of it as Claude Local or Claude Agent. It’s essentially a super-intelligent AI running locally, able to do… pic.twitter.com/F6iDwYPMRY

— Lenny Rachitsky (@lennysan) October 14, 2025

Whether it’s to manage your email, write peer performance feedback, or even be your Chief of Staff—people are putting sensitive, personal information into Claude Code. And the more we use it for non-coding work, the more the session files are valuable and private¹.

THE PERSONAL PANOPTICON. A few months ago, I started running my life out of Claude Code. Not out of intention to do so, it was just the place where everything met. And it just kept working...

— @mollycantillon

As a daily AI assistant, session data is no longer just code. It’s your personal archive, and it’s stored in plain text.

The problem

Claude Code session files are stored in plain text in your user folder. Take a look at ~/.claude/projects (mac/linux) or %USERPROFILE%\.claude\projects (windows). These files can be read by any software you run—including that npm package you (or Claude!) just installed.

This is basically CWE-312: Cleartext Storage of Sensitive Information.

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere

— Common Weakness Enumeration

What should change

Session files should be encrypted at rest, with the key stored in the system keychain. The same way Claude’s API keys are.

I say this reluctantly, because I’ve used the access more than once for my own projects (like absolutelyright.lol or an MCP server to share sessions between coding agents). But the openness is now becoming a security gap.