Updated
How end-to-end encrypted note sync works, and who can read your notes
How end-to-end encrypted sync works for notes: keys made from your password, what the server still sees, recovery phrases, and which apps can read your notes.
End-to-end encrypted sync encrypts each note on your device before it leaves, with a key that exists only on your devices. The server stores the encrypted bytes and hands them to your other devices, which decrypt them locally. Because the server never holds the key, the company running it cannot read your notes, and neither can an attacker who breaches it. The same fact means nobody can reset your encryption password: forget it without a backup such as a recovery phrase, and the synced copy is gone.
Whether your notes app can read your notes comes down to who holds the keys. Notion, Evernote, Google Keep, OneNote, Simplenote, UpNote and Apple Notes on a standard iCloud account hold the keys to what they store. Standard Notes, Notesnook, Anytype, Logseq Sync, Obsidian Sync on its default setting, Apple Notes with Advanced Data Protection and Jotura Sync encrypt end to end. The comparison table has each one, checked against the vendor’s own documentation in October 2026.
Three meanings of “encrypted”
A pricing page that says “encrypted” can mean any of three things, and only one keeps the provider out.
| Kind | What it stops | Who holds the key |
|---|---|---|
| In transit (HTTPS, TLS) | Someone reading your traffic on the network | The server, which decrypts on arrival |
| At rest, on the server | Someone walking off with the provider’s disks | The provider |
| End to end (E2EE) | The provider, an attacker inside it, a legal demand served on it | Only your devices |
Under the first two, the provider can read your notes, which powers its web app, server-side search and AI features. End-to-end encryption gives those up so the server stores only ciphertext, data that is unreadable without the key.
How end-to-end encrypted sync works, step by step
The numbers below are Jotura’s, from its security page.
- Your password becomes a key. A key derivation function turns your sync password into a key-encryption key. Jotura uses Argon2id with 64 MiB of memory, 3 passes and 4 lanes, which makes every password guess cost an attacker real time and memory.
- A random master key does the real work. The device generates 32 random bytes as a master key. It encrypts that key under the key from step 1, a step called wrapping. Changing your password then re-wraps one small key, and no note needs re-encrypting.
- Each file gets its own key. Every upload is encrypted with a fresh data encryption key, which is wrapped under the master key. Jotura uses XChaCha20-Poly1305, an authenticated cipher that detects any tampering with the ciphertext.
- Paths become fingerprints. To match new versions to old ones, the server receives
HMAC-SHA256(path_key, normalized_path), a keyed one-way fingerprint. The real filename travels encrypted alongside the wrapped file key. - Your other devices reverse it. A new device downloads the wrapped master key and asks for your password. It repeats step 1 to unwrap the key, and a verifier blob confirms the password before it decrypts any notes.
What the server stores, and what still leaks
End-to-end encryption covers note content, and the data a service needs to run accounts, devices and sharing sits outside it. Here is what a Jotura sync server holds.
| The server holds | Can the server read it? |
|---|---|
| Your account email, and the email and role of everyone you share with | Yes |
| Each device’s name, built from its hostname and operating system | Yes |
| Your vault’s folder name, and the name of every folder or note you share | Yes. Share names also appear in invite emails |
| Note content and filenames | No |
| HMAC path identifiers | No, they are one-way |
| The Argon2id salt and parameters, and the verifier blob | Yes, and none of them are secret |
| Your master key, wrapped once under your password and once under your recovery phrase | No |
| Public keys for your vault and account, private keys wrapped under your master key, and share keys sealed to each member | The public keys only |
Your sync password and recovery phrase never reach the server. Beyond the table, any sync service also sees:
- Connections. The IP addresses your devices connect from, and when.
- Shape. How many encrypted files you have and the size of each one.
- A stable pseudonym per note. The path identifier comes out the same every time, which is what lets sync work. It never reveals a name, yet the server can follow one unnamed note for years and watch it change and grow.
Sharing an encrypted note with another person
Sharing works through public-key cryptography. Every account has a key pair: a public key anyone may see, and a private key that stays on that person’s devices. A shared folder gets its own key, and the owner’s device encrypts that key to each member’s public key. The server relays the result without being able to open it.
A dishonest server could hand you its own public key and claim it is your colleague’s. Jotura shows a key code for every member, sixteen characters in four groups such as K7QD 2MXA P9RT 4HNE, for you to read to each other on a call. When a member’s key changes, Jotura marks them Key changed and seals nothing new to them until an owner or editor confirms the new code. The shared notes page covers roles and removal.
What happens when you forget the password
A provider without your key has nothing to reset. Each product decides what you get instead.
| Product | If you forget the encryption password |
|---|---|
| Jotura Sync | Your 12-word recovery phrase unlocks sync and sets a new password |
| Notesnook | A recovery key, or a backup file you saved earlier |
| Apple (Advanced Data Protection) | Your device passcode, a recovery contact, or a recovery key |
| Obsidian Sync (end to end) | No recovery. You create a new remote vault and upload again from your devices |
| Standard Notes | No reset. Export from a signed-in device, or start a new account |
| Anytype, EteSync, Joplin | No recovery |
In Jotura, a device that already has the key cached keeps syncing, and the markdown files on every device stay readable because they were never encrypted on disk.
The recovery phrase and its BIP39 checksum
A recovery phrase is a list of ordinary words that encodes a large random number. Jotura uses BIP39, the public standard behind cryptocurrency wallet phrases. The BIP39 specification sets these rules:
- The wordlist has 2,048 words, so each word carries 11 bits.
- A 12-word phrase holds 132 bits: 128 random bits plus a 4-bit checksum.
- The checksum is the first 4 bits of the SHA-256 hash of the random part.
- No two English words share their first four letters.
A word that is not on the list is always rejected. A wrong word from the list, or two swapped words, passes the 4-bit checksum 1 time in 16. Compare your written copy with the screen word by word.
You cannot choose your own words, because they encode random key material. Jotura turns the phrase into a key through BIP39’s standard seed step and then HKDF, and its strength comes from 128 random bits that nobody can guess the way people guess passwords.
Jotura shows the phrase once, when you enable sync, and asks you to type back three words. The server holds a copy of your master key wrapped under the phrase, never the phrase itself. The sync docs cover unlocking with it and replacing it.
Where to keep a recovery phrase
| Storage | Verdict |
|---|---|
| Paper, kept with your passport | Good. It stays offline and outlives any device |
| A stamped metal backup plate | Best for decades. It survives water and heat that would destroy paper |
| A password manager you can open without this phrase | Good, with a paper copy as well |
| A phone photo, a cloud document or an email to yourself | Bad. Each copy sits in another account that someone can breach |
Keep two copies in separate buildings, away from your sync password.
Which popular notes apps can read your notes
“Can read” means the company holds keys that decrypt your synced notes on its servers, per the linked vendor page in October 2026.
| App | Can the company read your synced notes? | Detail |
|---|---|---|
| Notion | Yes | AES-256 at rest with keys Notion holds. Staff access content only to troubleshoot or recover it, Notion says |
| Evernote | Yes | AES-256 at rest with Google-managed keys. Mac, Windows and Web can encrypt selected text under a passphrase, never a whole note |
| Google Keep | Yes | Encrypted in transit and at rest by Google. Workspace client-side encryption covers Drive, Docs, Gmail, Calendar and Meet, not Keep |
| Apple Notes, standard iCloud | Yes | Apple holds the keys. Locked notes are end-to-end encrypted with their own password |
| Apple Notes with Advanced Data Protection | No | Keys stay on your trusted devices. Dates and the pinned flag stay readable. Off until you turn it on |
| OneNote | Yes | Notebooks sit in OneDrive, encrypted at rest with Microsoft-managed keys. Password-protected sections use 128-bit AES |
| Simplenote | Yes | Encrypted in transit only. Simplenote says notes are not encrypted at rest and advises against storing anything sensitive |
| UpNote | Yes | Stored on Google’s Firebase, encrypted in transit and at rest. No end-to-end encryption |
| Obsidian Sync | No, on the default setting | AES-256-GCM with scrypt. Upload times and the device behind each upload stay visible. The optional “standard encryption” uses a key Obsidian manages and can decrypt |
| Standard Notes | No | XChaCha20-Poly1305 with Argon2id, open source. Owned by Proton since April 2024, which has no separate notes app |
| Notesnook | No | XChaCha20-Poly1305 with an Argon2i master key, open source |
| Anytype | No | The key is generated on your device, and Anytype says it holds no keys and cannot recover your account |
| Logseq Sync | No | Encrypted with age under a password, filenames included. |
| EteSync | No | Syncs notes, contacts and calendars. Client and server are open source |
| Joplin | Only with E2EE off | Off until you enable it. With it off, whoever hosts your sync target (Joplin Cloud, Dropbox, OneDrive) can read your notes |
| Bear | Apple can, Bear cannot | Syncs through iCloud, where Apple holds the keys unless Advanced Data Protection is on. Titles and tag names stay unencrypted either way. Bear Pro can encrypt individual notes with a separate password |
| Jotura Sync | No | Argon2id and XChaCha20-Poly1305 for content and paths. The vault’s folder name, shared names and device names reach the server in plaintext. Closed source and not independently audited |
Server-side keys are what make web access, password resets and team administration possible, and plenty of people choose that trade on purpose.
On AI training, Notion says that by default neither it nor its AI subprocessors train models on customer data, and model providers keep non-Enterprise AI requests for up to 30 days. Evernote says none of its AI features train on your notes, and its AI Assistant sends the text you ask about to OpenAI.
What else on your computer can read your notes
When your notes are plain files in a folder, every program running under your user account can read them.
| What reads your notes folder | Why |
|---|---|
| Backup software | It copies every file it is pointed at |
| Antivirus | It scans file contents |
| The system search indexer (Spotlight, Windows Search) | It opens files to index the text |
| Cloud folder clients (Dropbox, iCloud Drive, OneDrive) | A vault inside a synced folder is uploaded under that provider’s keys |
| Plugins in your notes app | A plugin runs with the app’s own access to your files and the network |
| An AI assistant you gave file access | You granted it the folder |
Full-disk encryption leaves this picture unchanged. FileVault on macOS, BitLocker on Windows and LUKS on Linux protect a machine that is off or stolen. Once you log in, the disk is decrypted for every process you run. Android and iOS keep each app’s storage private from other apps.
How to check what an app sends
Check the app’s settings for a telemetry toggle, then watch its traffic. LuLu is a free macOS firewall that asks before any app connects out and shows the destination. On Windows, Resource Monitor’s Network tab lists the addresses each process talks to. From a terminal on macOS or Linux:
lsof -i -n -P | grep -i jotura
Swap in the app you are checking. An app’s own update server is routine, and an analytics company deserves a closer look.
Where Jotura fits, including what it does not protect
Jotura keeps your notes as plain markdown files in a folder you choose and sends no analytics or telemetry. It encrypts nothing on disk, which leaves at-rest protection to full-disk encryption.
Two features send your data off the machine. Sync sends it encrypted, with the plaintext names listed above. Search by meaning, on desktop, preselects OpenAI as its recommended provider, and with OpenAI chosen your note text and search queries go to OpenAI under your own API key. The Local provider runs a model on your machine and sends nothing.
Forget key on this device clears the cached sync key, and Sign out other devices ends every other session on your account. Both leave the markdown files on each disk, so delete the vault and wipe the drive before you hand a computer on. Backups of the vault folder can include .jotura/sync.db, which holds the wrapped copies of your master key.
Jotura is closed source and has had no third-party security audit, so its encryption claims rest on its published design and on the network check above. Standard Notes and Notesnook publish their code, which is a stronger position.
Jotura has no plugins, which removes a local read path and means you cannot extend it. There is no iOS app, so an iPhone cannot open your synced notes. Sync costs £4 a month or £40 a year ($5 or $50 in the US), with no free trial; see pricing.
Frequently asked questions
Can an end-to-end encrypted notes app reset my password?
No. The provider never holds your encryption key, so it has nothing to reset. You can recover your account sign-in through email, which only proves which encrypted data belongs to you. Getting the notes back takes your password, a recovery phrase or key, or a device that still holds the key.
Is end-to-end encrypted sync slower?
No. Encryption and decryption run on your own device and take far less time than the network round trip. The deliberately slow step, deriving a key from your password, runs once when you unlock.
What should I do if someone sees my Jotura recovery phrase?
Act as if they have your master key. The phrase plus a copy of your vault’s .jotura/sync.db unwraps it with no email code. Jotura cannot rotate the master key, so a new phrase or password leaves it unchanged. Use Sign out other devices to end any session they hold, protect the email account that receives your sign-in codes, and replace the phrase in Settings under Security & recovery.