Not every "encrypted" notepad encrypts your notes
Plenty of note apps advertise privacy while storing your content in readable form on their servers. The lock icon protects the screen, not the data. A genuinely encrypted notepad does the cryptography on your device, so the server, if there is one, only ever receives ciphertext.
That's the first thing to verify. Look for a plain explanation of where encryption happens and where the keys live. Phrases like "bank-level security" without that explanation usually mean the service can read everything.
Local, synced, or both
Encrypted notepads come in two basic shapes, and each protects against different things.
| Local only | Synced | |
|---|---|---|
| Where notes live | In this browser or device | An encrypted copy on a server, plus your devices |
| Works offline | Yes | Yes, if the app keeps notes locally too |
| Survives a lost or wiped device | No, unless you export | Yes |
| What the server can see | Nothing | Ciphertext, its size, and when you save |
| Main risk | Losing the device or clearing browser data | A weak password, since it protects the server copy |
Local-only is the most private and the most fragile. Synced is convenient, but the password you choose becomes the thing protecting the copy on the server, so it needs to be long and unique.
Offline-first matters more than it sounds
An offline-first notepad lets you keep writing when the network is slow or absent, and saves on your device first. That's a reliability feature, and also a privacy one: you're less tempted to paste a private draft into some other app while you wait for a connection.
Exports matter for the same reason. A notepad that can export notes in a form you can open without the service means you're never locked in, and you have a backup if the service disappears.
Keeping a private journal
Journals hold names, health details, plans and feelings, the kind of writing that should be private by default. A few habits make an encrypted notepad a good home for one:
- Use a long passphrase you don't use anywhere else, and keep it in your password manager.
- Lock your devices. Encryption in the app doesn't help if someone can open your unlocked laptop with the notepad already open.
- Export now and then to an encrypted file you control, so a cleared browser or a lost phone doesn't take months of entries with it.
- Make it quick to open. A journal only works if you write in it, and a tool that fights you every time won't get used.
The checklist
Before trusting an encrypted notepad with private notes, check that:
- encryption happens on your device, before anything is uploaded;
- you can start without an account, and sync is optional;
- it works offline;
- it can export notes you can open without the service;
- it's clear about what the server stores when you do sync.
How ProtectedShare's notepad fits
ProtectedShare's encrypted notepad is a Markdown scratchpad. In local mode the vault stays in your browser and nothing is uploaded; the key for local mode is kept in the same browser, so it keeps your notes away from the server, not from someone who can use your browser profile. For multi-device sync you choose a username and password, and the server stores the encrypted vault, a SHA-256 hash of the username and a password proof that authorizes saves, never the text. Any note can be exported as a self-decrypting HTML file that opens offline with its password.
One honest detail: the notepad still uses ProtectedShare's original encryption scheme, AES-256-GCM with a key stretched by PBKDF2-SHA256 at 210,000 iterations, rather than the newer scheme used for shared links. The security page describes both.
If you want to send a note to someone rather than keep it, use a secure note instead. It's built for one-time delivery and deletes itself after reading.