Privacy & Security
How to keep your notes encrypted — a practical guide for privacy-conscious individuals, researchers, and professionals who want end-to-end encrypted note storage that prevents third-party access to their personal knowledge base.
Notes are among the most revealing documents a person creates. A personal knowledge base accumulates years of thinking: ideas in development, research on sensitive topics, meeting records, personal decisions, financial observations, health notes, opinions about people and situations. A calendar reveals when meetings occurred. A note-taking system reveals what was thought, decided, and learned.
Most consumer note-taking applications are designed for convenience, not privacy. The default data model: the user creates notes in the application; the application syncs them to cloud servers operated by the provider; the provider stores notes in a form they can access for purposes ranging from search indexing to backup to legal compliance.
This is fine for notes that contain nothing sensitive. For notes that contain sensitive professional information, source-protected research, personal medical observations, legal strategy, or simply private thinking that the user doesn't intend to share with their SaaS provider, the default model has a privacy cost.
End-to-end encryption for notes means that the content of notes is encrypted before leaving the user's device. The cloud service receives and stores encrypted data — it cannot read the content. When the user accesses notes on another device, the application downloads the encrypted data and decrypts it locally. The encryption keys stay on the user's devices; the provider never has access to them.
This guide explains how end-to-end encryption for notes works, which tools implement it correctly, and how to maintain an encrypted note-taking practice across devices and backups.
Not all "encrypted" note-taking is the same. Three distinct models:
1. Provider-controlled encryption (common, not private):
The provider encrypts data at rest on their servers. They describe this as "your notes are encrypted." What they mean: the data on disk is encrypted, but the provider holds the encryption keys. The provider can decrypt and read any user's notes. This is standard practice for most cloud services.
Examples: Google Keep (encrypted at rest, Google holds keys), Notion (encrypted in transit and at rest, provider-controlled keys).
2. End-to-end encryption with account-based keys (stronger):
The user's password (or a derived key) is used as the basis for encryption. The encryption and decryption happen on the client. The provider receives only encrypted data. To read a note, the provider would need the user's password — which they don't have.
The limitation: if the user loses their password and the provider doesn't have the key, recovery is impossible or limited to a recovery key the user must store separately.
Examples: Standard Notes (E2EE, zero-knowledge), ProtonMail's Proton Drive (E2EE for notes/files).
3. Local-only storage with OS-level encryption (maximum control):
Notes are stored as local files, never sent to any cloud. Full-disk encryption (FileVault on macOS, BitLocker on Windows) encrypts the storage medium. No network transmission; no cloud provider; no provider-held keys.
Limitation: no built-in sync across devices. The user must arrange their own sync (Syncthing, a USB drive, a self-hosted solution) if they want notes on multiple devices.
Examples: Obsidian (local-first), Zettlr, plain text files with a text editor.
The key distinction:
"Encrypted at rest" on a cloud server (provider-controlled keys) does not protect against provider access or legal disclosure. True end-to-end encryption (client-generated keys, provider cannot decrypt) does. Local-only storage eliminates the provider entirely.
Standard Notes
Standard Notes is the most accessible end-to-end encrypted note application. It uses E2EE by default with no opt-in required; the zero-knowledge architecture means the provider cannot access note content. Notes are encrypted on the device before sync. The application is open-source and has been independently security-audited.
Features: web, desktop (macOS, Windows, Linux), and mobile apps; encrypted sync; rich text and markdown notes; file attachments; browser extension for web content capture. Free tier available; paid tiers add more editor types and advanced features.
Privacy posture: Standard Notes stores encrypted blobs on its servers; without the user's credentials, the content cannot be decrypted. Their privacy policy explicitly states they have no ability to read note content.
Joplin with E2EE enabled
Joplin is an open-source note-taking application with optional end-to-end encryption. E2EE must be enabled by the user (it's not on by default). When enabled, notes are encrypted before sync to any supported service (Nextcloud, WebDAV, Dropbox, OneDrive, S3).
This architecture means Joplin isn't tied to a specific sync provider — the user can choose where encrypted notes are stored. A user who self-hosts a Nextcloud instance has encrypted notes on a server they control, with E2EE keys they hold.
Features: desktop (macOS, Windows, Linux) and mobile apps; web clipper extension; markdown notes; E2EE across sync backends; CLI version available. Open-source; free.
Privacy posture: with E2EE enabled, the sync provider cannot read note content. Without E2EE, notes are unencrypted on the sync provider's servers. Enable E2EE before adding notes.
Obsidian with Cryptomator
Obsidian itself stores notes as local markdown files with no cloud sync (when used in local mode). The files are on the user's device and encrypted by OS full-disk encryption.
For users who want Obsidian notes synced across devices with E2EE, Cryptomator provides a solution. Cryptomator creates an encrypted vault on the local system that syncs to any cloud provider (Dropbox, iCloud, Google Drive, OneDrive). Files are encrypted before they leave the local device. The cloud provider stores only encrypted data.
The result: Obsidian notes in a Cryptomator vault on iCloud or Dropbox are accessible on multiple devices while being encrypted at the cloud level.
Privacy posture: the cloud provider cannot read the vault contents. Obsidian itself uses standard filesystem access; Cryptomator handles the encryption layer.
Notesnook
Notesnook is an end-to-end encrypted note application designed explicitly as a privacy-focused alternative to Evernote. E2EE is enabled by default. The application is open-source. Zero-knowledge architecture — the provider cannot read notes.
Features: web, desktop (macOS, Windows, Linux), and mobile apps; rich text and markdown notes; image attachments; web clipper; E2EE sync. Free tier with limited features; paid tier for full features.
Standard Notes is the clearest starting point for users new to encrypted notes:
Step 1: Create an account
Go to standardnotes.com and create an account. Use a strong, unique password — this password is the basis of the encryption key. Standard Notes cannot reset your password or recover your notes if you lose it.
Step 2: Write down (or store) your recovery key
Standard Notes generates a recovery key during account creation. Store this key somewhere secure and offline — a password manager, a printed sheet in a secure location. This key is the only way to access notes if the password is forgotten and two-factor authentication is unavailable.
Step 3: Install the desktop application
The desktop application is available for macOS, Windows, and Linux. Log in with the account credentials. Notes sync automatically; the sync is encrypted end-to-end.
Step 4: Install the browser extension
The Standard Notes Web Clipper (available for Chrome and Firefox) captures web content to Standard Notes. Clipped content is encrypted before sync, same as all notes.
Step 5: Enable two-factor authentication
In account settings, enable 2FA using an authenticator app (Authy, 1Password, or any TOTP app). This prevents account access from a compromised password alone.
Verification:
Log out of all devices. Log back in with the password. Confirm that notes are visible. This verifies the encryption and decryption are working correctly.
Joplin requires E2EE to be configured explicitly:
Step 1: Install Joplin
Download from joplinapp.org. Available for macOS, Windows, Linux, iOS, and Android.
Step 2: Configure a sync target
In Tools → Options → Synchronization, select a sync target. Options include Dropbox, OneDrive, Nextcloud, WebDAV, S3. Configure the connection.
Step 3: Enable E2EE
In Tools → Options → Encryption, enable end-to-end encryption. Create an encryption password (separate from the sync account password). This encryption password encrypts all notes before they sync.
Critical: the encryption password is not stored anywhere by Joplin. If it's lost, notes in the encrypted vault are permanently inaccessible. Store the encryption password in a password manager.
Step 4: Sync on all devices
On every other device with Joplin installed, configure the same sync target and enter the same encryption password. Notes will sync encrypted; each device decrypts locally.
The security model for encrypted notes depends on the user not losing their encryption credentials. Practices for managing this:
Use a password manager for the note application's password:
Standard Notes, Notesnook, and similar services derive encryption keys from the user's password. A strong password (20+ random characters) managed in a password manager (1Password, Bitwarden, KeePass) is both secure and reliably accessible.
Store recovery keys offline:
Most E2EE services generate a recovery key at account creation. Print the recovery key and store it in a physically secure location (a safe, a safety deposit box, or a sealed envelope in a trusted location). A recovery key that only exists in the same device as the notes it protects does not protect against device loss.
Test recovery before depending on it:
After setting up encrypted notes, test the recovery process: log out of all devices; log back in using the recovery key (not the password). Confirm that notes are accessible. Do this when the notes contain nothing irreplaceable, so any recovery failure is discoverable before it's catastrophic.
What happens if keys are lost:
For tools with zero-knowledge E2EE (Standard Notes, Notesnook, Joplin with E2EE): notes are permanently inaccessible if both the password and recovery key are lost. The provider cannot decrypt notes on the user's behalf — that's the privacy property. This is the correct behavior; it's also an irreversible data loss if credentials are not stored carefully.
For users with notes in an unencrypted system (Evernote, Notion, Apple Notes, Google Keep):
Step 1: Export existing notes
Every major note application supports data export. Export in a format compatible with the target application:
.enex format (Joplin, Standard Notes, and others import .enex).zip with JSON files (via Google Takeout)Step 2: Import into the encrypted application
Standard Notes, Joplin, and Notesnook all support importing from common formats. The import process adds the existing notes to the encrypted vault; they're then encrypted and synced.
Step 3: Verify the import
After import, verify that the notes appear correctly in the new application before deleting them from the old system.
Step 4: Delete from the old system
After confirming the import, delete notes from the old application and request account deletion if appropriate. Deletion from the provider's servers happens according to the provider's data deletion policy — some providers retain data for a period after deletion.
Encryption protects notes when the device is locked or the data is in transit. It doesn't protect against an unlocked device being physically accessible.
Automatic screen lock:
Set the device to lock after a short period of inactivity (30-60 seconds). An unlocked device bypasses note encryption entirely.
Application-level lock (where available):
Some encrypted note applications (Standard Notes, Joplin) support an application-level PIN or biometric lock — the application locks separately from the device, requiring an additional credential to access notes. Enable this for devices that others have physical access to.
Note application permissions:
Encrypted notes on a phone are only as secure as the phone. Ensure the phone has a strong lock screen passcode (not just biometrics, which can be compelled). Full-disk encryption on iOS and Android is enabled by default on modern devices with a lock screen set.
Setup: A nurse practitioner wants to keep notes on difficult cases for personal learning — observations, pattern recognition, notes on reasoning. These notes should not exist on systems accessible to her employer or to third-party cloud services that could be subject to HIPAA-related legal processes. She wants notes available on her personal laptop and her personal phone.
What she uses:
What she avoids:
The tradeoff: She accepts that password loss could mean loss of notes. She manages this by treating the recovery key as critical infrastructure — stored offline, tested once after setup. She accepts the loss of convenience features in more powerful SaaS tools (collaboration, templates, web apps) in exchange for control over where her personal professional thinking lives.
Keeping notes encrypted is primarily a tool selection decision. Most major note-taking applications are not end-to-end encrypted; the user's note content lives on the provider's servers in a form the provider can access. Switching to a genuinely E2EE application — Standard Notes, Joplin with encryption enabled, or Notesnook — is the single most important step. Local-only storage (Obsidian, plain text files) eliminates the provider as a risk entirely, at the cost of managing sync independently. The operational requirement that follows from either choice: treat the encryption credentials (password, recovery key) as critical, because losing them means losing access to the notes. Managed carefully, encrypted notes provide meaningful privacy protection with minimal everyday friction.
More WebSnips articles that pair well with this topic.
How to Audit a browser extension's permissions — a practical, example-driven guide with honest tool comparisons and a clear place for WebSnips. Written for Lawyers.
How to avoid vendor lock-in with your notes — a practical guide for individuals and teams who want to keep their personal knowledge base portable, format-independent, and recoverable regardless of which application or service they use.
How to back up your notes safely — a practical guide for individuals and professionals who want reliable, secure backups of their personal knowledge base, covering backup strategies, encrypted backup tools, and recovery testing for note-taking applications.
How to capture sensitive research securely — a practical guide for researchers, journalists, legal professionals, and privacy-conscious individuals who need to gather and store sensitive information without creating avoidable exposure through insecure capture tools or storage practices.
How to choose a private web clipper — a practical guide for privacy-conscious researchers, journalists, and professionals who want to clip and save web content without exposing their browsing patterns, source materials, or clipped content to third-party services.
How to comply with GDPR in your knowledge base — a practical guide for teams and organizations who store personal data in their internal wikis, documentation systems, and knowledge management tools, covering data minimization, retention policies, access controls, and subject rights.