How to Back Up Your Notes Safely

Why Notes Are Especially Vulnerable to Loss

Notes represent a category of data that is simultaneously highly valuable and frequently unbacked-up. Unlike documents produced for formal purposes (reports, spreadsheets, presentations), notes are produced continuously, informally, and often in applications that handle their own sync without the user having to think about storage.

This produces a false sense of security. "My notes are in Obsidian (or Notion, or Evernote, or Joplin)" does not mean the notes are safely backed up. It means the notes are stored in a specific application. Whether those notes are protected against data loss depends on where the application stores them and whether that storage is itself backed up.

The common data loss scenarios for notes:

Application account deletion or service shutdown: If a user's Evernote account is closed (by the user, or by the service in response to a terms of service violation, or by the service shutting down), the notes in that account are lost unless they've been exported. A cloud service shutting down with inadequate notice — a realistic possibility for smaller note-taking services — eliminates years of accumulated notes.

Sync conflicts and corruption: When the same notes are edited on multiple devices, sync conflicts can cause data to be overwritten or lost. A note that was present on a desktop is replaced by an earlier version from a mobile device because sync resolved the conflict in the wrong direction.

Accidental deletion: Notes accidentally deleted — an entire notebook, a significant project — are recoverable in some applications for a limited period (Evernote has a 30-day trash; Notion has a 30-day page history on paid plans). After that period, they're permanently gone.

Account compromise: A compromised account may result in notes being deleted by an attacker, or the account may be locked out making notes inaccessible.

Local storage failure: For applications that store notes locally (Obsidian, Joplin in local mode), a hard drive failure without backup is permanent data loss.

Application data corruption: Application databases can become corrupted. A corrupted Joplin database or Obsidian vault may be unreadable.

The defense against all of these is the same: reliable backups that are independent of the application's own storage.

---

The 3-2-1 Backup Rule Applied to Notes

The 3-2-1 backup rule is a standard data protection principle:

• 3 copies of the data
• 2 different storage media/types
• 1 copy offsite (or in a different location from the primary)

Applied to notes:

Copy	Where	Example
Primary	Application storage	Notes in Obsidian vault / Joplin / Evernote
Backup 1	Different local medium	External hard drive or backup folder on same device
Backup 2	Offsite / cloud	Encrypted cloud backup (Backblaze, iCloud, encrypted folder)

For notes, "offsite" means: a copy that would survive if the primary device were destroyed, stolen, or compromised. A backup stored on the same device as the primary is not offsite.

---

Backup Strategies by Note-Taking Application

Obsidian (local markdown files):

Obsidian stores notes as plain text markdown files in a vault folder on the local filesystem. This makes backup straightforward: back up the vault folder.

Automated local backup: On macOS, Time Machine (built-in backup to an external drive or Time Capsule) includes the Obsidian vault folder automatically if it's in the home directory. Configure Time Machine and it handles Obsidian backups without additional action.

On Windows: Windows Backup (Settings → System → Storage → Backup Options) can include the Obsidian vault folder. Alternatively, use Macrium Reflect (free) or Veeam Agent (free for personal use) for local backup.

Cloud backup for the vault folder: Obsidian Sync (paid, from Obsidian) provides sync and version history across devices. For external cloud backup, put the vault folder in iCloud Drive, Dropbox, or Google Drive. The cloud service backs up files as they change.

Encrypted cloud backup: For privacy-conscious users who don't want the cloud provider accessing notes, Cryptomator creates an encrypted vault in any cloud folder. The Obsidian vault inside a Cryptomator vault is encrypted before upload. On each device, mount the Cryptomator vault and Obsidian opens the vault folder from within it.

Git-based version control: Obsidian users can initialize the vault folder as a Git repository and push to a private GitHub or GitLab repository. This provides both backup and version history (the ability to recover any previous version of any note). The Obsidian Git plugin automates periodic commits and pushes.

Joplin:

Joplin stores notes in a local database (for local-only mode) or syncs to a configured backend (Dropbox, OneDrive, Nextcloud, WebDAV, or Joplin Server). Backup strategy depends on the sync configuration.

Local-only mode: The Joplin database is stored in the application data folder:

• macOS: ~/.config/joplin-desktop/database.sqlite
• Windows: %APPDATA%\joplin-desktop\database.sqlite
• Linux: ~/.config/joplin-desktop/database.sqlite

Back up this file using any backup tool. Importantly: this single file contains all notes, notebooks, and tags.

Joplin also provides an export function (File → Export → Joplin Export Format or JEX). Export regularly and store the export file in a separate backup location.

Sync-enabled mode: When Joplin syncs to a cloud service (Dropbox, etc.), that cloud service provides one backup copy. The local Joplin database is another copy. For 3-2-1 compliance, add a third backup: an exported JEX file stored in a different location.

With E2EE: If Joplin's end-to-end encryption is enabled, the sync backend stores encrypted data. A backup of that encrypted data is also encrypted — it requires the E2EE password to restore. Store the E2EE password (and the master key) in a password manager so it's available for recovery.

Standard Notes:

Standard Notes syncs to Standard Notes' servers by default (end-to-end encrypted — the provider stores only encrypted blobs). The primary copy is on the Standard Notes server; secondary copies are the local application data on each synced device.

Export for offline backup: Standard Notes supports export (File → Export → JSON or Plain Text). Export periodically and store the export file in a separate backup location (an encrypted folder, a password-protected archive, or a local backup drive).

Standard Notes Backup extension: On paid plans, Standard Notes provides an automated backup extension that exports notes on a schedule to Dropbox or another configured location. This automates the export step.

The encryption consideration: Exported notes are unencrypted (they're exported as readable text/JSON to be useful for import into other applications). Store Standard Notes exports in an encrypted location — a Cryptomator vault, a password-protected zip file, or a device with full-disk encryption.

Evernote / Notion / cloud-first applications:

For cloud-first applications where the primary storage is the provider's servers:

Regular exports: Evernote: File → Export Notes → ENEX format (the official format that can be re-imported or used with Joplin's importer). Notion: Settings → Content → Export All Workspace Content (generates a ZIP of markdown and HTML files).

Export frequency: Monthly exports are a reasonable minimum for active note-takers. Weekly exports for high-value research. The export is the only backup that would allow recovery if the cloud account is lost.

Store exports encrypted: Cloud service exports stored in another cloud service aren't much safer. Store exports on a local encrypted drive or in an encrypted archive.

---

Encrypted Backup for Sensitive Notes

For notes containing sensitive personal, professional, or client information, backups should be encrypted. Unencrypted backups are data breaches waiting for storage media to be found.

Cryptomator for cloud backup:

Cryptomator creates an encrypted vault that syncs to any cloud service (Dropbox, iCloud, Google Drive, OneDrive). Files placed in the vault are encrypted before being uploaded. The cloud provider stores only encrypted data.

Setup: install Cryptomator, create a vault in the cloud sync folder, set a vault password, place notes or note exports in the vault. On any other device, install Cryptomator, unlock the vault with the password, and access the files.

Encrypted archive files:

For one-time or periodic backup exports, create an AES-256 encrypted ZIP or 7z archive:

• 7-Zip (Windows, free): Right-click → 7-Zip → Add to archive → Encryption method: AES-256 → Set a strong password
• Keka (macOS): Drag files to Keka → Select encryption → Set password

These encrypted archives can be stored anywhere — a cloud service, an external drive, a USB drive — without the storage medium needing special security.

Backblaze B2 with encryption:

Backblaze B2 is an affordable S3-compatible cloud storage service. Combined with a client like Rclone (configured with encryption), Rclone can encrypt files locally and upload encrypted versions to B2. Backups are encrypted in transit and at rest; Backblaze cannot read the content.

Rclone encrypted backup setup (command line):

# Configure an encrypted remote pointing to B2
rclone config
# Create a new remote, choose "crypt" type
# Point it at your B2 bucket
# Set an encryption password

# Backup notes folder
rclone sync ~/Documents/notes notes-encrypted:/

This creates automated encrypted backups to cloud storage at a low cost (~$0.006/GB/month).

---

Recovery Testing: The Often-Skipped Step

A backup that hasn't been tested for recovery is not a reliable backup. Common failure modes:

• The backup file is corrupted
• The backup process has been failing silently for weeks
• The application version used for backup is different from the version needed for recovery
• The encryption key needed for recovery is not accessible

Recovery testing practice:

Quarterly: export notes from the primary application; import the export into a fresh instance of the same application (or open the backup files) and confirm that notes are intact and readable.

Annually: simulate a full device failure. On a spare device or in a fresh user account, install the note-taking application, configure it to connect to the backup, and verify that all notes are accessible.

What to verify in a recovery test:

• All notebooks/folders are present
• Note count is approximately correct (spot-check that expected notes are there)
• Note content is readable and accurate (not corrupted)
• Attachments and images are present in notes that had them
• Search is functional on the recovered notes

---

Backup Schedule Recommendations

Note volume	Export frequency	Local backup	Cloud backup
Light (< 100 notes, low update rate)	Monthly export	Weekly automated backup	Monthly cloud sync
Moderate (100-1000 notes, regular updates)	Weekly export	Daily automated backup	Daily cloud sync
Heavy (1000+ notes, daily updates)	Daily export or continuous sync	Daily automated backup	Continuous cloud sync

For applications with continuous sync (Obsidian with iCloud sync, Standard Notes), cloud backup is effectively continuous. The export backup schedule applies to the one-time backup file that provides a recovery point independent of the sync service.

---

Worked Example: A Writer's Complete Notes Backup System

Setup: A freelance writer uses Obsidian for all research and writing notes — thousands of notes accumulated over 3 years. She writes on a MacBook Pro and iPad. Notes are synced via Obsidian Sync (paid).

Her backup system:

Primary: Obsidian Sync provides sync and version history (up to 12 months) across all devices.

Backup 1 — Time Machine: Her MacBook is connected to a Time Capsule once weekly. Time Machine backs up the entire vault folder including all notes. She can restore any file from the past year.

Backup 2 — Encrypted cloud: The Obsidian Git plugin is configured to push the vault to a private GitHub repository every 24 hours. The repository provides both offsite backup and complete version history for every note.

Backup 3 — Periodic export: Monthly, she runs a manual export of her vault (ZIP of all markdown files) and stores it in a Cryptomator-encrypted vault in Dropbox. This provides an export independent of Obsidian's format.

Recovery test: Twice a year she opens the GitHub repository on a colleague's laptop, clones the vault, opens it in Obsidian, and verifies that everything is readable. Once a year she also tests restoring from the Cryptomator-encrypted export.

What she'd lose in various failure scenarios:

• MacBook stolen → restored from Time Machine + Obsidian Sync within hours
• Obsidian Sync account terminated → restored from GitHub within hours
• GitHub account lost → restored from Time Machine (or Cryptomator export)
• All three fail simultaneously → Cryptomator monthly export is up to 30 days old

---

Key Takeaways

1. Syncing is not backing up: notes in Obsidian, Standard Notes, or Joplin that sync to a cloud service have one copy in the cloud — if that service fails or the account is lost, the sync copy is gone too; backups are additional copies, not the sync.
2. The 3-2-1 rule — three copies, two media types, one offsite — provides comprehensive protection: primary storage, a local backup, and an offsite (cloud) backup cover all common failure scenarios.
3. Export backups provide recovery independent of the application and the account: a JEX export (Joplin), ENEX export (Evernote), or markdown export (Obsidian/Notion) can be opened without the original account or application.
4. Backups of sensitive notes should be encrypted: unencrypted backup archives on cloud storage are accessible to the provider; use Cryptomator, encrypted zip files, or a client-side encrypted backup tool.
5. Recovery testing is mandatory: a backup that has never been tested has unknown reliability; test recovery quarterly for confidence that the backup will work when needed.

---

Conclusion

Backing up notes safely requires treating notes as valuable data deserving the same backup discipline applied to documents and photos: multiple copies, at least one offsite, tested periodically. The specific implementation depends on the note-taking application — Obsidian's markdown files backup differently than Joplin's database, which backs up differently than Evernote's account-based storage — but the principle is consistent. Regular exports provide recovery points independent of the application and account; automated backup tools (Time Machine, Veeam, Rclone) provide continuous or frequent copies; encrypted cloud storage provides the offsite copy with privacy. The investment is a few hours of initial setup and a quarterly test; the protection is against data loss that could eliminate years of accumulated knowledge.

Try WebSnips free — capture and annotate backup guides, data protection resources, and note security practices with your own context notes, tag by application and risk scenario, and build the organized knowledge base that ensures your research and notes are protected.