Encrypted Notes

The regular notepad stores plaintext in local storage — private from the internet, but readable by anyone at your unlocked computer. This one stores only ciphertext: without the passphrase, what's on disk is indistinguishable from random bytes, even to someone with full access to the machine.

Your passphrase is stretched into a 256-bit key via PBKDF2-SHA256 (310,000 iterations — deliberately slow to make guessing expensive), then the note is encrypted with AES-256-GCM using a fresh random salt and IV. Only the encrypted bundle is written to local storage; the passphrase itself is never stored anywhere.

The note is unrecoverable — full stop. There's no reset email because there's no server, and no backdoor because a backdoor for you is a backdoor for everyone. GCM authentication means a wrong passphrase yields an error rather than garbage, but never a partial recovery. Treat the decrypted .txt export as your backup strategy.

Local storage is per-browser: clearing site data deletes the (encrypted) note, and it doesn't follow you across devices. And while the note is unlocked, its plaintext lives in the tab's memory like any text you're editing. Encryption at rest is the guarantee; an unlocked screen is still an unlocked screen.