Encrypted Task Sync in 2026: Comparing Your Options

A task list is a to-do log and a confession log at the same time: call the oncologist, file the paperwork, renew the visa before it lapses. Todoist, Microsoft To Do, Apple Reminders, Google Tasks, EteSync, and SilentSuite each treat that list differently. This post compares them on what the server can read, whether recurrence and reminders survive a move, and who holds the keys. SilentSuite is the one built on the Etebase protocol, which encrypts task content on your device.

Tasks are the worst category in personal information management for privacy, and it is not close. Calendars have Proton and Tuta. Contacts have Tuta. Task lists have one mainstream encrypted option (Apple Reminders, and only if you turned on a setting that is off by default) plus two Etebase implementations. The mainstream task apps hold your task titles and notes in readable form, and one of them does not offer an open sync protocol at all.

Which task apps can the server read?

Values reflect vendor documentation as of 2026-08-15. Sources are linked in the sections below.

Apple Reminders reads “Partial” because the answer depends on a setting: with Advanced Data Protection on, Reminders is end-to-end encrypted; ADP is opt-in and off by default, and reminders synced through CalDAV are excluded from it. That is also why the Apple CalDAV cell is “Yes*”: the protocol works, and using it opts those reminders out of end-to-end encryption. “Via bridge” means a local daemon on your own machine decrypts and serves CalDAV VTODO on 127.0.0.1.

Notice what the recurrence and reminders columns do. Every option here supports both. Nobody is choosing between privacy and a working task app on those features, so the interesting columns are the first two.

Is Todoist end-to-end encrypted?

No. Todoist's privacy and security page, last updated 2026-08-14, documents TLS for data in transit and encryption at rest, and makes no end-to-end encryption claim anywhere.

That is a description of the page, not an accusation. Encryption at rest with the provider holding the keys protects against someone stealing a disk. It does not put the provider outside the trust boundary. Todoist is an excellent task manager with the best natural language recurrence parsing in this comparison, and it is built on the assumption that the service can read and process your tasks. Both things are true at once.

Is Microsoft To Do end-to-end encrypted?

No, and the proof is in Microsoft's own API. The Graph todoTask resource exposes title, body, dueDateTime, reminderDateTime, recurrence, status, importance, categories, and checklistItems as ordinary readable fields, with no encryption described. A server that returns a task's title and body over an API holds them in a form it can read.

Microsoft has not published a page saying “Microsoft To Do is not end-to-end encrypted.” It does not need to. The API reference is the evidence, and it is first-party.

Are Apple Reminders end-to-end encrypted?

Yes, conditionally, and this row deserves care because Apple is the one mainstream competitor here that genuinely got it right. Reminders is one of the categories covered by Advanced Data Protection, which raises the number of end-to-end encrypted iCloud categories from 14 to 23.

Three limits, all of which matter:

• Advanced Data Protection is opt-in and off by default. If you have not turned it on, your reminders are not end-to-end encrypted.
• Reminders synced using CalDAV are excluded. Apple documents this explicitly, so the moment you sync a reminders list through CalDAV you are outside the guarantee.
• It is Apple-only in practice. The encryption is real and so is the ecosystem boundary.

Worth contrasting with the rest of Apple's personal information management, because people generalise in the wrong direction here. The same security guide states: “Because of the need to interoperate with the global email, contacts, and calendar systems, iCloud Calendar, Contacts, and Mail aren't end-to-end encrypted.” Reminders is in; calendar and contacts are out. I took that split apart in SilentSuite vs Apple iCloud Calendar.

Why can't you sync Google Tasks over CalDAV?

Because Google's CalDAV API does not support VTODO, the iCalendar component that represents a task. Google Calendar answers CalDAV for events. Tasks are not reachable that way at all. The only route in is the proprietary Google Tasks API, which, as the Tasks.org documentation notes, lags the features of Google's own first-party app.

That makes tasks the most locked-in category at Google. Your calendar can leave over a standard protocol. Your contacts can leave over CardDAV. Your task list can leave through one vendor-specific API, on whatever terms that API offers.

This is the portability axis, and it is separate from encryption. CalDAV VTODO is what lets an open task client such as Tasks.org read a list that some other piece of software wrote. A service without it is asking you to trust that its own apps will always be the apps you want.

How does SilentSuite handle tasks?

SilentSuite treats tasks as a first-class item type on the Etebase protocol, alongside calendars and contacts. Task titles, notes, due dates, recurrence rules, and reminder times are encrypted on your device before they reach the server. The SilentSuite server stores ciphertext and sees item existence, item counts, and revision timestamps, which is set out field by field in what SilentSuite actually encrypts.

For portability, the SilentSuite bridge runs on your own machine, decrypts locally, and serves CalDAV VTODO over 127.0.0.1. Any CalDAV task client can read the same lists, and the server never sees plaintext because the plaintext only exists on your device. On Android, the SilentSuite app syncs tasks natively. iOS is on the roadmap, coming soon, and is not currently supported.

EteSync does the same thing with the same protocol, and its bridge, etesync-dav, exposes VTODO the same way. The difference is maintenance: the EteSync Android app shipped v2.7.0 on 2026-03-09 and hosted signup is open, while the server repository has not been committed to since July 2024 and the bridge's last functional release was v0.35.1 in August 2025. EteSync is mostly abandoned. The full component-by-component picture is in SilentSuite vs EteSync.

One honest caveat about bridged tasks: recurrence rules are expressive, and how faithfully a given rule survives a round trip between a task client and any sync layer is a question you should test with your own lists rather than take on trust from a comparison table.

What does encrypted task sync cost in 2026?

Prices as of 2026-08-15. Google Tasks, Microsoft To Do, and Apple Reminders are bundled with accounts most people already have, and none of the three is a paid task product in its own right. Todoist has a free tier and paid plans that I did not re-verify from Todoist for this post, so no figure is quoted here. EteSync hosted is $2/month billed yearly for Personal and $4/month billed yearly for Supporter. SilentSuite is from €3/mo (annual) on the Early Adopter tier, or free if you self-host the AGPL-3.0 server.

Which encrypted task app should you choose?

If you are entirely on Apple devices, turn on Advanced Data Protection and use Reminders. It is genuinely end-to-end encrypted, it is already installed, and it costs nothing. Do not sync those lists over CalDAV, because that takes them back out of the guarantee.

If you are not on Apple, or you want your tasks in the same encrypted account as your calendar and contacts, or you want an open protocol that any task client can read, the field narrows to Etebase. EteSync works and still ships; SilentSuite is the actively maintained continuation of the same protocol, with an AGPL-3.0 server you can run yourself.

If you are on Todoist and you love it, the honest answer is that no encrypted task app in this comparison matches its natural language input. That is a real trade, and it is worth naming rather than pretending away.

FAQ

Is Todoist end-to-end encrypted?
No. Todoist documents encryption in transit and at rest and does not claim end-to-end encryption, which means Todoist holds the keys.

Is Microsoft To Do end-to-end encrypted?
No. The Microsoft Graph todoTask resource returns task titles, bodies, due dates, reminders, and recurrence as readable fields.

Are Apple Reminders end-to-end encrypted?
Yes, if Advanced Data Protection is enabled. ADP is opt-in and off by default, and reminders synced through CalDAV are excluded.

Can I sync Google Tasks with CalDAV?
No. Google's CalDAV API does not support VTODO, so tasks are reachable only through the proprietary Google Tasks API.

Which task apps support CalDAV VTODO?
EteSync and SilentSuite through a local bridge, and Apple Reminders directly, though syncing a reminders list over CalDAV takes it outside Advanced Data Protection. Todoist, Microsoft To Do, and Google Tasks do not support VTODO at all.

How much is SilentSuite?
From €3/mo (annual) on the Early Adopter tier during the public beta, or free if you run the AGPL-3.0 server yourself.

This post is the matrix. For the same field in narrative form, with a section per service and more on why a task list is a record of what you intend to do next, read encrypted to-do lists in 2026. And if you want tasks your provider cannot read, get started with SilentSuite. No tracking.