The file

Unencrypted .kcal files can be opened with SQLite tools. Encrypted files require SQLCipher and the password.

Killendars default to %APPDATA%\Killendar. Manage Killendars can switch the catalog to any writable local folder, or place it beside Killendar.exe for a self-contained portable copy. A machine-wide install still defaults to a separate profile folder for each Windows account.

What is inside it

• events - one row per appointment.
• categories - the color definitions. They live in the Killendar rather than in settings, so they travel with the file when you move or share it.
• meta - schema version and the app version that created the file, for forensics on a file that turns up years later.
• deleted, templates and reminder_state - Recently deleted for 30 days, saved templates, and which reminders were dismissed or snoozed. Daily backups go to a Backups folder beside the file.

Time

Timed appointments are stored in UTC and converted at the edges, so a calendar carried to another timezone still says the right thing.

All-day entries are the exception, and deliberately so: they are floating calendar dates, stored unconverted with no Z. Converting them to UTC would slide an all-day appointment to the previous day for everyone east of UTC.

An appointment can also keep a time zone of its own, once Show time zones is ticked in the date settings. Its times are typed on that zone's clock and stored with the zone's name, so a 9:00 meeting in Tokyo stays at 9:00 there when either place changes its clocks.

Encryption

Encryption is opt-in. With no password the file is plain SQLite. Set one from the lock button in the title bar and the whole file is encrypted at rest with SQLCipher.

The same button changes the password, or removes it and writes the file back out as plain SQLite. An encrypted Killendar asks for its password on launch; a wrong one just asks again.

There is no password recovery

The app says so before you commit to one. If a password is lost the locked Killendar is renamed aside and kept on disk rather than destroyed, and a new empty one opens in its place - so a forgotten password costs you access, not the file.

What the encryption does not protect

Worth stating plainly rather than implying otherwise:

• Nothing is protected while the app is open and unlocked.
• It is no defense against a keylogger, a memory dump, or someone who has your password.
• settings.json stays plaintext. It holds the theme, locale, window position and which Killendar is active.
• An .ics export is plain text by definition. Exporting from an encrypted Killendar writes an unencrypted copy, and the app warns you at the moment of export rather than after.

iCalendar

Import and export are written against RFC 5545 directly by Killendar's own parser; only time zone names are looked up with the TimeZoneConverter library. Import skips appointments already in the calendar and reports how many were added and how many were skipped.

Categories travel through both, using the standard CATEGORIES property, so they survive a trip through another calendar app. A category you import but have never defined shows in neutral gray rather than being dropped or silently created - deleting a category is meant to stick, and an import should not quietly undo that.

Repeats go out as RRULE, including the first to fourth or last weekday of a month, with extra dates as RDATE and skipped ones as EXDATE. Time zones travel with their VTIMEZONE definitions, and a file's own definition is read when Windows does not know the name. A newer invite for a meeting already here (a higher SEQUENCE) updates it and a cancellation removes it, after the import asks.

Keyboard

Almost everything is a single key, no modifier. That is only safe because of one rule: a bare-letter shortcut never fires while you are typing. The moment focus is in a text field every single-key binding stands down, so a w in a title is a w and not a jump to week view. The modified combinations are checked first and work regardless, because they cannot collide with typing.

Mouse: Ctrl+wheel over Month view changes the visible range from one to six weeks, giving busy days more vertical room. Ctrl+wheel over Week or Day changes time-grid density.

Running it

Only one instance runs at a time. A second launch hands its file to the window already open and exits, rather than leaving two copies of the app writing to one database - which is the quickest way to corrupt SQLite.

Double-clicking a .kcal copies it into your data folder and opens the copy, leaving the original where it is. A Killendar is written to constantly, and SQLite over a network share is a well known way to lose a database.

Signing

Releases are Authenticode signed. The About card shows the publisher, the certificate thumbprint and the SHA-256 of the running exe, and it validates the signature with WinVerifyTrust rather than merely reading the embedded certificate - so a tampered build cannot display a signer it does not own. The chain check is cache-only, so opening About never stalls waiting on the network.

Glossary