What Lives in Your Notes (and Why It Matters)
Be honest about your notes app's contents: Wi-Fi passwords for the router you never changed, recovery codes, passport photos, medical notes, that list of every account you own. Now consider that most notes apps — Apple Notes, Evernote, Google Keep, OneNote — encrypt in transit and at rest on their servers, but hold the keys themselves. Your notes are one subpoena, one breach, or one confused employee away from exposure.
Zero-knowledge encrypted apps close that hole: encryption happens on your device, the provider stores only ciphertext, and your passphrase never leaves your machine. Same model your password manager uses — for the notes that would hurt if leaked.
Standard Notes — The Security Benchmark
Standard Notes (from the Secure Document Foundation lineage) is the most deliberately paranoid option: zero-knowledge AES-256 encryption on every note by default, encrypted attachments on paid plans, and a unique feature among note apps — double encryption with your own secondary key if you want it. Free tier: unlimited notes on all devices (plain text only); paid (~$90/year) adds attachments, encrypted file vault, and rich formats.
The trade-off is intentional minimalism: even with the rich-text extension, it's a writing environment, not a workspace. No databases, no canvases, no ecosystem race. For recovery codes, account inventories, and anything you'd dread leaking, that focus is the feature.
Obsidian + Syncthing — Best for Ownership
Obsidian itself stores plain Markdown files — not encrypted by default. The privacy play is architecture: notes live on your devices, sync via Syncthing (peer-to-peer, no cloud server at all) or a self-hosted host, and sensitive folders get an encryption plugin (e.g., Meld Encrypt) or file-level encryption. Nobody can read what never touches a server.
This is the strongest privacy architecture in this comparison — and the most work. You are the infrastructure: sync conflicts, backups, and device setup are your job. Right for the technical and the sovereignty-minded; overkill for everyone else. (Our notes app comparison covers Obsidian's general strengths.)
Notesnook and Joplin — The Open-Source Contenders
Notesnook is the modern all-rounder: zero-knowledge encryption on everything including attachments, polished apps on every platform, Markdown support, and a genuinely good free tier (unlimited notes and sync on core features). Paid (~$50/year) unlocks rich editing and bigger uploads. It reads like what you'd get if a password manager team built a notes app — because the threat model is the same.
Joplin is the open-source veteran: end-to-end encryption (opt-in — turn it on!), sync via your own Dropbox/OneDrive/WebDAV, notebooks and tags, and total data ownership. The security is solid but opt-in, and the interface is functional rather than lovely. Best for people who want encryption plus cheap storage they already pay for.
The Tiered Setup We Actually Recommend
One app for everything rarely fits security tiers. The setup that works:
- Critical secrets (recovery codes, account inventory): your password manager's secure notes, not any notes app — it already has your 2FA and breach monitoring.
- Sensitive personal (health, legal, financial notes): Notesnook or Standard Notes — zero-knowledge, synced, low friction.
- Everything else (ideas, recipes, drafts): whatever app you love. Apple Notes, Notion, whatever — the blast radius is small.
The principle from our privacy guide applies: match protection to stakes. Encrypting your grocery list is performance; leaving recovery codes in plaintext is negligence.
