Password protection is optional
Without a notebook password, note records are saved unencrypted in this browser’s app storage. Other websites are normally isolated by the browser, but anyone with access to your browser profile or device may be able to access its data.
When password protection is enabled, notebook item contents and settings are encrypted before storage with AES-GCM using a 256-bit key derived with PBKDF2-SHA-256. Original media stored in notebook item records is included. The stored envelope still includes identifiers and modification information. The app must decrypt content while you work on it.
The password itself is not saved for recovery. NoteTisa cannot recover a lost encryption password. Keep it safely and test a backup before relying on it.
What the password does not protect
- Cloud sign-in tokens in the separate browser key/value store and public provider configuration.
- Downloaded files, copied text, printed pages, screenshots or ordinary readable document exports.
- Content you deliberately send to AI, publish, share, email or give to collaborators.
- A compromised device, malicious browser extension, malware or hostile code running in an unlocked tab.
- All network metadata, public asset caches, record identifiers or hosting access records.
Notebook encryption is not a claim that every feature has the same end-to-end protection. Shared documents have their own invitation and encryption-key handling. Treat collaboration invitations and keys as sensitive: recipients can retain or forward content, and removing access does not erase copies they already obtained.
Backups, exports and cloud copies
A full notebook backup made while password protection is active can contain encrypted records. Read the export’s description and check its contents: ordinary HTML, Markdown, text, research and publishing exports are intended to be readable and may not retain notebook encryption.
Cloud sync transfers notebook packages, using the notebook’s encryption when enabled. Sync may also carry deletions or mistakes. Keep a separate dated backup with its password and original media, and verify it can be restored in another browser profile.
Safer everyday use
- Keep your browser and operating system updated and use HTTPS.
- Use a trusted browser profile and review installed extensions.
- Lock the notebook when leaving the device; do not rely only on closing a panel.
- Disconnect integrations you no longer need and revoke their provider grants.
- Check Status for actual save/sync results and keep independent backups.
No independent penetration-test certification, regulatory-compliance certification or guarantee of invulnerability is claimed. The compatibility and verification page distinguishes current automated evidence from checks that remain outstanding.
Reporting a security concern
Check the contact status before sending a report. Do not post passwords, keys, tokens, real notebook backups or private note contents in a public issue or message. Describe the affected version and steps using a minimal invented example.