diff --git a/Atomic-Blog-Generation-Pipeline/visuals/posts/encrypted_notes_privacy.py b/Atomic-Blog-Generation-Pipeline/visuals/posts/encrypted_notes_privacy.py new file mode 100644 index 0000000..d70803d --- /dev/null +++ b/Atomic-Blog-Generation-Pipeline/visuals/posts/encrypted_notes_privacy.py @@ -0,0 +1,71 @@ +"""Figures for S4: How Does Encryption Protect Privacy? 5 Gaps in Your Notes.""" +from atomic_viz import figure, banner, box, phone + +GAPS = [("TRANSPORT", "HTTPS ends at the server"), ("KEYS", "The provider may hold them"), ("METADATA", "Dates and sizes stay visible"), + ("ANALYTICS", "Tracking runs outside encryption"), ("RECOVERY", "A reset path is a key")] + + +def build(): + out = {} + + rows = "".join(f'
' + f'{i + 1:02d}' + f'{a}
{b}
' + for i, (a, b) in enumerate(GAPS)) + art = box(740, 90, 400, 470, f'
ENCRYPTED, BUT...
{rows}', cls="sigshadow", style="padding:16px 22px") + out["01-banner"] = banner("SECURITY · PRIVACY", 'HOW DOES ENCRYPTION PROTECT PRIVACY?', + "It locks content. Five gaps sit outside the lock.", art, title_size=86, text_width=640) + + descs = ["The server unwraps your note on arrival.", "Server side keys mean the company can read.", "When, how much, how often: all readable.", + "SDKs report usage beside your notes.", "If they can reset you in, they can read in."] + body = "" + for i, ((t, _), d) in enumerate(zip(GAPS, descs)): + body += box(56 + i * 220, 220, 200, 330, f'
{i + 1:02d}
{t}
{d}
', + cls="sigshadow" if i == 1 else "", style="padding:16px 16px") + out["02-five-gaps"] = figure("FIG 1 · THE GAPS", 'ENCRYPTED IS NOT THE SAME AS PRIVATE', body, + "Each gap sits outside the cipher. A strong cipher doesn't close any of them.", h=650) + + yes, no = 'YES', 'NO' + data = [("ICLOUD NOTES", "Standard", "Apple", yes, "Apple can help"), + ("ICLOUD NOTES", "With ADP", "Your devices", no, "Recovery key or contact"), + ("GOOGLE KEEP", "Default", "Google", yes, "Google account"), + ("ATOMIC NOTES", "T2T, default", "No note key", 'IN TRANSIT', "Google sign-in"), + ("ATOMIC NOTES", "Vault on", "Your phone", no, "Six-word phrase only"), + ("TYPICAL E2E APP", "Default", "Your devices", no, "Recovery key, if any")] + trs = "".join(f"{a}{b}{c}{d}{e}" for a, b, c, d, e in data) + body = (f'' + f'{trs}
APPSETUPKEY HELD BYPROVIDER CAN READRECOVERY
') + out["03-key-custody"] = figure("FIG 2 · KEY CUSTODY", 'SAME WORD, DIFFERENT KEY HOLDER', body, + "From Apple, Google, and Atomic Notes documentation, October 9, 2026. Atomic T2T: your Drive holds readable files.", h=760) + + items = ["When the note was created", "When it was last modified", "When it was last viewed", "Whether it's pinned", + "Whether it's marked as deleted", "Whether it has a drawing or handwriting", "A checksum of imported content"] + li = "".join(f'
' + f'{i + 1:02d}{x}
' for i, x in enumerate(items)) + body = box(56, 196, 640, 470, f'
STAYS UNDER STANDARD PROTECTION
VISIBLE TO APPLE
{li}', cls="warn") + body += box(740, 196, 404, 470, '
END-TO-END WITH ADP
HIDDEN
' + '
Note titles, text, and attachments.
' + '
Apple documents both lists. That openness is what every app should offer.
', cls="signal") + out["04-metadata-stays"] = figure("FIG 3 · METADATA", 'WHAT ADVANCED DATA PROTECTION STILL SHOWS', body, + "Source: Apple's iCloud data security overview, checked October 9, 2026.", h=760) + + qs = [("WHERE?", "In transit, at rest, or on your device?"), ("WHOSE KEY?", "Yours alone, or theirs too?"), ("WHAT'S VISIBLE?", "Is there a published metadata list?"), + ("WHAT ELSE IS SENT?", "Analytics, crash reports, ads, AI?"), ("HOW DO I RECOVER?", "If they can reset you, they can read.")] + body = "" + for i, (q, d) in enumerate(qs): + x, yy = 56 + (i % 3) * 370, 196 + (i // 3) * 230 + body += box(x, yy, 340, 200, f'
{i + 1:02d}
{q}
{d}
', + cls="sigshadow" if i == 1 else "", style="padding:14px 20px") + out["05-five-questions"] = figure("FIG 4 · THE CHECK", 'FIVE QUESTIONS FOR ANY APP', body, + "Vague answers usually mean the gap is real.", h=700) + + body = phone(12, 64, 190, 260, crop=470, shadow="ink") + facts = [("WHERE", "HTTPS always. On the phone too, with the vault"), ("WHOSE KEY", "Vault: yours, from six words"), + ("VISIBLE", "IDs, type, flags, times, rough size"), ("ALSO SENT", "Nothing. No analytics or trackers"), + ("RECOVERY", "Your phrase only. No reset path"), ("HONEST LIMITS", "Vault off by default. No audit yet")] + rws = "".join(f'
' + f'{a}{b}
' for a, b in facts) + body += box(400, 190, 744, 500, f'
ATOMIC NOTES
{rws}
', cls="sigshadow") + out["06-atomic-answers"] = figure("FIG 5 · OUR ANSWERS", 'ATOMIC NOTES, SAME FIVE QUESTIONS', body, + "It's my app, so the bar is higher. Every answer is checkable in its public code.", h=760) + return out diff --git a/Atomic-Blog-Generation-Pipeline/visuals/posts/storing_passwords_in_notes_app.py b/Atomic-Blog-Generation-Pipeline/visuals/posts/storing_passwords_in_notes_app.py new file mode 100644 index 0000000..87f125d --- /dev/null +++ b/Atomic-Blog-Generation-Pipeline/visuals/posts/storing_passwords_in_notes_app.py @@ -0,0 +1,68 @@ +"""Figures for S3: Storing Passwords in Notes App, 5 Real Dangers.""" +from atomic_viz import figure, banner, box, phone, arrow + + +def build(): + out = {} + + note = ("
NOTE · LOGINS
" + + "".join(f'
{a}
' + for a in ["email: ••••••••••", "bank: ••••••••", "wifi: ••••••••••", "phone carrier: •••••", "mother's maiden name: ••••", "netflix: same as bank"])) + art = box(740, 110, 400, 400, note, cls="warn", style="padding:18px 22px") + out["01-banner"] = banner("SECURITY · PASSWORDS", 'STORING PASSWORDS IN A NOTES APP', + "Five real dangers of a note called logins, and how to move out in twenty minutes.", art, title_size=88, text_width=640) + + # Blast radius. + body = box(56, 360, 240, 130, '
ONE NOTE
"LOGINS"
', cls="warn") + body += box(410, 360, 240, 130, '
THE MASTER KEY
EMAIL
', cls="ink") + targets = [("BANK", 200), ("SOCIAL", 330), ("CLOUD STORAGE", 460), ("SHOPPING", 590)] + for t, y in targets: + body += box(800, y - 10, 340, 96, f'
RESET BY EMAIL
{t}
', style="padding:12px 18px") + lines = arrow(300, 425, 402, 425, color="err", width=4.5) + for _, y in targets: + lines += arrow(654, 425, 792, y + 38, color="err") + out["02-blast-radius"] = figure("FIG 2 · THE BLAST RADIUS", 'ONE NOTE, EVERY ACCOUNT', body, + "Most accounts reset through your inbox. Whoever reads the email password can reach the rest.", lines=lines, h=740) + + y, n, p = 'YES', 'NO', 'SOMETIMES' + rows = [("Encrypts each stored secret", p, y), ("Fills only on the matching site", n, y), ("Warns about breached passwords", n, y), + ("Generates strong passwords", n, y), ("Flags reused passwords", n, y), ("Separate master password", p, y), + ("Hidden from normal search", n, y)] + trs = "".join(f"{a}{b}{c}" for a, b, c in rows) + body = (f'' + f'{trs}
FEATURENOTES APPPASSWORD MANAGER
') + out["03-notes-vs-manager"] = figure("FIG 1 · TWO DIFFERENT TOOLS", 'A NOTE IS NOT A PASSWORD MANAGER', body, + "Sometimes: a few notes apps can lock or encrypt a note, but none adds the other features.", h=740) + + rows = [("GOOGLE KEEP", n, n, n, n), ("SAMSUNG NOTES", 'NOTE LOCK', n, n, n), + ("APPLE NOTES", 'NOTE LOCK', 'WITH ADP', n, n), + ("ATOMIC NOTES", 'APP LOCK', 'OPTIONAL VAULT', n, n), + ("PASSWORD MANAGER", y, y, y, y)] + trs = "".join(f"{a}{b}{c}{d}{e}" for a, b, c, d, e in rows) + body = (f'' + f'{trs}
APPLOCKE2E SYNCBREACH ALERTSSAFE AUTOFILL
') + out["04-apps-compared"] = figure("FIG 3 · POPULAR APPS", 'IS YOUR NOTES APP SAFE FOR PASSWORDS?', body, + "Checked October 9, 2026. ADP is Apple's Advanced Data Protection, off by default.", h=640) + + steps = [("01", "PICK A MANAGER", "Protect it with a long passphrase used nowhere else."), + ("02", "EMAIL FIRST", "Move it and change it. Email resets everything."), + ("03", "MONEY AND PHONE", "Bank, card, and phone carrier logins next."), + ("04", "TWO-STEP ON", "Authenticator app or passkey on those accounts."), + ("05", "DELETE THE NOTE", "Then empty the notes app's trash.")] + body = "" + for i, (num, t, d) in enumerate(steps): + body += box(56 + i * 220, 220, 200, 320, f'
{num}
{t}
{d}
', + cls="sigshadow" if i == 1 else "", style="padding:16px 16px") + out["05-move-out"] = figure("FIG 4 · MOVING OUT", 'TWENTY MINUTES, IN THIS ORDER', body, + "Highest blast radius first. A deleted note often stays in the trash for 30 days.", h=620) + + body = phone(12, 64, 190, 260, crop=470, shadow="ink") + facts = [("GOOD FOR", "Journals, health notes, plans, drafts"), ("PROTECTION", "App lock and an optional end-to-end vault"), + ("NO AUTOFILL", "Can't stop you pasting into a fake site"), ("NO BREACH ALERTS", "Won't tell you a password leaked"), + ("NO GENERATOR", "Can't create unique passwords"), ("VERDICT", "Not a password manager. Use one.")] + rws = "".join(f'
' + f'{a}{b}
' for a, b in facts) + body += box(400, 190, 744, 500, f'
ATOMIC NOTES, HONESTLY
{rws}
', cls="sigshadow") + out["06-atomic-notes-card"] = figure("FIG 5 · RIGHT TOOL, RIGHT JOB", 'MY APP IS NOT A PASSWORD MANAGER', body, + "I build Atomic Notes. I'd rather you used it for notes and a password manager for passwords.", h=760) + return out diff --git a/Atomic-Blog-Generation-Pipeline/visuals/posts/switch_notes_app.py b/Atomic-Blog-Generation-Pipeline/visuals/posts/switch_notes_app.py new file mode 100644 index 0000000..86c4077 --- /dev/null +++ b/Atomic-Blog-Generation-Pipeline/visuals/posts/switch_notes_app.py @@ -0,0 +1,73 @@ +"""Figures for S5: Switch Notes App Safely, 7 Checks Before You Move.""" +from atomic_viz import figure, banner, box, phone, arrow + +CHECKS = [("EXPORT FORMAT", "Markdown, HTML, or JSON travel well"), ("ATTACHMENTS", "Count them before you move"), + ("ENCRYPTION", "Unlock on your own device to export"), ("RECOVERY", "Know the new app's way back in"), + ("OFFLINE", "Open the new app in airplane mode"), ("STORAGE", "Who holds the synced copy?"), + ("SHUTDOWN RISK", "How would you leave the new app?")] + + +def build(): + out = {} + + rows = "".join(f'
' + f'{i + 1:02d}' + f'{a}
' for i, (a, _) in enumerate(CHECKS)) + art = box(740, 92, 400, 460, f'
BEFORE YOU MOVE
{rows}', cls="sigshadow", style="padding:16px 22px") + out["01-banner"] = banner("MIGRATION · 2026", 'SWITCH NOTES APP SAFELY', + "Seven checks, a rollback copy, and a two-week overlap. Nothing left behind.", art, title_size=96, text_width=640) + + body = "" + for i, (t, d) in enumerate(CHECKS): + x, yy = 56 + (i % 4) * 275, 196 + (i // 4) * 230 + body += box(x, yy, 255, 205, f'
{i + 1:02d}
{t}
{d}
', + cls="sigshadow" if i == 0 else "", style="padding:14px 18px") + body += box(881, 426, 255, 205, '
THEN
FOLLOW THE PLAN
Export, freeze a copy, import, count, wait.
', cls="signal", style="padding:14px 18px") + out["02-seven-checks"] = figure("FIG 1 · THE CHECKS", 'SEVEN CHECKS BEFORE YOU MOVE', body, + "Each one has cost someone their notes. Most take a minute.", h=700) + + data = [("GOOGLE KEEP", "Google Takeout", "HTML and JSON", "Each note as two files"), + ("APPLE NOTES", "Export as Markdown", "Markdown + images", "iOS 26 or macOS Tahoe. No folders"), + ("EVERNOTE", "Desktop app only", "ENEX or HTML", "100 notes at a time, or notebooks"), + ("NOTION", "Settings or page menu", "Markdown + CSV, HTML, PDF", "Databases arrive as CSV"), + ("OBSIDIAN", "Nothing to do", "Markdown files", "Plugins' data may not travel"), + ("ATOMIC NOTES", "No button yet", "JSON files in your Drive", "Vault notes stay encrypted")] + trs = "".join(f"{a}{b}{c}{d}" for a, b, c, d in data) + body = (f'' + f'{trs}
APPHOWYOU GETWATCH FOR
') + out["03-export-formats"] = figure("FIG 2 · EXPORTS", 'HOW POPULAR APPS LET YOU LEAVE', body, + "Checked against each app's help pages on October 9, 2026.", h=680) + + steps = [("01", "EXPORT", "Everything, with attachments."), ("02", "FREEZE A COPY", "Zip it. Put it somewhere else. Don't touch it."), + ("03", "IMPORT", "From a second copy, never the frozen one."), ("04", "COUNT", "Notes, checklists, attachments."), + ("05", "OVERLAP", "Use both apps for two weeks."), ("06", "RETIRE", "Close the old account last.")] + body = "" + for i, (num, t, d) in enumerate(steps): + body += box(56 + i * 183, 230, 165, 300, f'
{num}
{t}
{d}
', + cls="sigshadow" if i == 1 else "", style="padding:14px 14px") + out["04-migration-plan"] = figure("FIG 3 · THE PLAN", 'A MOVE WITH A WAY BACK', body, + "Step 2 is the rollback copy. It exists so you never have to use it.", h=620) + + marks = [(0, "DAY 0", "Export and freeze the rollback copy"), (1, "DAY 1", "Import, then count"), + (2, "DAYS 2 TO 14", "Use both apps. Search for old notes"), (3, "DAY 15", "Close the old account"), + (4, "ONE YEAR", "Keep the rollback copy until then")] + body = '
' + for i, lbl, d in marks: + x = 56 + i * 222 + cx = x + 100 + body += f'
' + body += box(x, 300, 200, 170, f'
{lbl}
{d}
', + cls="sigshadow" if i in (0, 4) else "", style="padding:14px 16px") + out["05-timeline"] = figure("FIG 4 · TIMING", 'TWO WEEKS OF OVERLAP, ONE YEAR OF BACKUP', body, + "Yearly notes, like tax lists, won't show up in two weeks. The rollback copy covers them.", h=560) + + body = phone(3, 64, 190, 260, crop=470, shadow="ink") + facts = [("WHERE NOTES LIVE", "One JSON file per note in your own Drive"), ("GETTING OUT", "Download the folder, convert with a script"), + ("VAULT NOTES", "Stay encrypted. Only the app opens them"), ("GETTING IN", "No import tool yet. Paste by hand"), + ("EXPORT BUTTON", "Not built yet. It's planned"), ("LOCK-IN", "None by format. The files are yours")] + rws = "".join(f'
' + f'{a}{b}
' for a, b in facts) + body += box(400, 190, 744, 500, f'
MOVING WITH ATOMIC NOTES
{rws}
', cls="sigshadow") + out["06-atomic-notes-card"] = figure("FIG 5 · OUR APP, HONESTLY", 'IN AND OUT OF ATOMIC NOTES', body, + "I build it. The way out works today with a script. A one-tap export is still to come.", h=760) + return out diff --git a/content/blog/best-end-to-end-encrypted-notes-apps.md b/content/blog/best-end-to-end-encrypted-notes-apps.md index abdbf79..2a18ea8 100644 --- a/content/blog/best-end-to-end-encrypted-notes-apps.md +++ b/content/blog/best-end-to-end-encrypted-notes-apps.md @@ -202,6 +202,7 @@ My take: there's no single most secure notes app. There's the one whose key you - [Encrypted notes explained: T2T vs end to end encryption](/blog/encrypted-notes-explained) - [7 best private notes apps for Android](/blog/best-privacy-first-notes-apps-android) - [Notes app metadata: 8 things it knows without reading notes](/blog/notes-app-data-collection) +- [Encrypted is not private: 5 gaps to check](/blog/encrypted-notes-privacy)

Atomic Notes by DevBehindYou

diff --git a/content/blog/best-local-first-note-taking-apps.md b/content/blog/best-local-first-note-taking-apps.md index 292e750..6ce5423 100644 --- a/content/blog/best-local-first-note-taking-apps.md +++ b/content/blog/best-local-first-note-taking-apps.md @@ -238,6 +238,7 @@ I also left out apps that call themselves offline-friendly but keep the primary - [What is a local first notes app?](/blog/what-is-a-local-first-notes-app) - [Local first architecture: the 4 layers behind Atomic Notes](/blog/atomic-notes-architecture) - [Notes app without internet: why offline should be the default](/blog/why-notes-should-work-offline) +- [Switch notes app safely: 7 checks before you move](/blog/switch-notes-app)

Atomic Notes by DevBehindYou

diff --git a/content/blog/best-offline-notes-apps-android.md b/content/blog/best-offline-notes-apps-android.md index 46e2170..7904edc 100644 --- a/content/blog/best-offline-notes-apps-android.md +++ b/content/blog/best-offline-notes-apps-android.md @@ -247,6 +247,7 @@ My take: the best offline notes app Android owners can install is the one they n - [Notes app without internet: why offline should be the default](/blog/why-notes-should-work-offline) - [6 best local first note taking apps](/blog/best-local-first-note-taking-apps) - [7 best private notes apps for Android](/blog/best-privacy-first-notes-apps-android) +- [Moving apps? 7 checks before you switch](/blog/switch-notes-app)

Atomic Notes by DevBehindYou

diff --git a/content/blog/encrypted-notes-explained.md b/content/blog/encrypted-notes-explained.md index de7873b..96dd7f6 100644 --- a/content/blog/encrypted-notes-explained.md +++ b/content/blog/encrypted-notes-explained.md @@ -195,6 +195,7 @@ My take after building both modes: most notes don't need the vault, and some enc - [Notes app metadata: 8 things it knows without reading notes](/blog/notes-app-data-collection) - [Notes app privacy: 9 red flags to check](/blog/notes-app-privacy-red-flags) - [5 best end to end encrypted notes apps, compared](/blog/best-end-to-end-encrypted-notes-apps) +- [How does encryption protect privacy? 5 gaps](/blog/encrypted-notes-privacy)

Atomic Notes by DevBehindYou

diff --git a/content/blog/encrypted-notes-privacy.md b/content/blog/encrypted-notes-privacy.md new file mode 100644 index 0000000..6ec627e --- /dev/null +++ b/content/blog/encrypted-notes-privacy.md @@ -0,0 +1,189 @@ +--- +title: "How Does Encryption Protect Privacy? 5 Gaps in Your Notes" +slug: "encrypted-notes-privacy" +description: "How does encryption protect privacy, and where does it stop? Five gaps between encrypted and private: transport, key custody, metadata, analytics, and recovery." +excerpt: "\"Your data is encrypted\" is true for almost every notes app. Whether your notes are private depends on five things the label doesn't tell you." +author: "ashutosh-sharma" +publishedAt: "2026-10-09" +updatedAt: "2026-10-09" +category: "security" +tags: ["encryption", "privacy", "security", "metadata", "threat-model"] +featured: false +draft: false +coverImage: "/blog/encrypted-notes-privacy/01-banner.png" +coverAlt: "Cover reading How Does Encryption Protect Privacy, with a padlock card listing five gaps: transport, keys, metadata, analytics, and recovery" +canonical: "https://atomic-notes.devbehindyou.com/blog/encrypted-notes-privacy" +keywords: "how does encryption protect privacy, encryption and privacy, encrypted notes privacy, transport encryption, provider held keys, metadata, analytics, account recovery, key custody, Advanced Data Protection, encryption marketing, server side keys, threat model" +readingTime: "10 min read" +--- + +
+

Quick answer

+

Encryption protects privacy by making your notes unreadable to anyone without the key. It only keeps the company out if the key never leaves your devices. Even then, metadata, analytics, account recovery, and the company's own policies can still expose you. Encrypted is one part of private, not the whole thing.

+
+ +Nearly every notes app says "your data is encrypted". Most of them mean it. And many of them can still read your notes, see when you write them, and hand them over if asked. + +So **how does encryption protect privacy**, exactly? It locks content against anyone who doesn't hold the key. The catch is in that last part: who holds the key, what sits outside the lock, and who can change the rules later. + +I build Atomic Notes, which offers both plain transport encryption and an optional end-to-end vault. This guide is about the gaps between encryption and privacy that marketing pages skip, including the ones in my own app. + +## How does encryption protect privacy? + +**It turns readable data into ciphertext that only a key can reverse.** Anyone who intercepts or steals the ciphertext without the key gets nothing useful. That's the whole promise. + +The protection depends on where the lock sits and who's on the other side of it. A thief on café Wi-Fi, a hacker who breaches a server, an employee, a government request, and someone holding your unlocked phone are five different threats. Each kind of encryption stops some of them and not others. + +Pick a threat and an encryption setup to see where the lock helps: + +:::widget threat-matrix + +The pattern is clear once you try a few. Encryption is strong against outsiders. Against the company that runs the service, only end-to-end encryption helps. Against someone holding your unlocked phone, no encryption helps at all. That's your threat model in one table. + +## What does encryption protect privacy from, and what not? + +**It's excellent against outsiders and useless against anyone already holding a key or your unlocked phone.** Knowing which side of that line each threat sits on is the whole skill. + +Here's how encryption and privacy line up against the threats people actually face with notes: + +| Threat | Stopped by HTTPS | Stopped by encryption at rest | Stopped by end-to-end | +|---|---|---|---| +| Someone on the same Wi-Fi | Yes | No | Yes | +| A stolen server disk | No | Yes | Yes | +| A hacker inside the provider's systems | No | Usually not | Yes | +| The provider itself, or a legal demand to it | No | No | Yes | +| Someone holding your unlocked phone | No | No | No | +| An analytics SDK inside the app | No | No | No | + +Two rows say "no" everywhere, and they matter more than people expect. Your phone's screen lock and an app lock handle the first one. Choosing an app without trackers handles the second. No cipher does either job. + +So how does encryption protect privacy in practice? It shrinks the list of people who could read your notes. The rest of this guide is about the names that stay on that list even after encryption, and how to find them for any app you use. + +## Why doesn't "encrypted" mean private? + +**Because encryption only covers the content, and only from the people who don't hold the key.** Five common gaps sit outside that lock. + +![Five gap cards: transport encryption ends at the server, the provider may hold the keys, metadata stays visible, analytics run outside encryption, and account recovery can reopen the lock.](/blog/encrypted-notes-privacy/02-five-gaps.png "Fig 1. Five gaps between encrypted and private. Each one is easy to miss in a feature list.") + +### 1. Transport encryption ends at the server + +**HTTPS protects your note on the way there, then the server unwraps it.** It's the minimum every app should have, and it says nothing about what happens on arrival. + +Transport encryption stops someone on the same network from reading your notes. It doesn't stop the service, its staff, or anyone who breaches it. When a privacy page leads with "encrypted in transit", read the next sentence carefully. Phrases like "bank-level" or "military-grade" encryption tell you the cipher, usually AES, which nearly everyone uses. They never tell you who holds the key, and that's the part that decides your privacy. + +### 2. The provider may hold the keys + +**Encryption at rest with server side keys protects against stolen disks, not against the company.** If the provider can decrypt your notes to show them in a web app or reset your password, it can decrypt them for other reasons too. + +Apple's iCloud is a clear, well-documented example. Under standard data protection, iCloud Notes are encrypted in transit and on Apple's servers, but Apple holds the keys. Turn on Advanced Data Protection and Notes become end-to-end encrypted, with keys only on your trusted devices. Same app, same cipher, very different key custody. + +Google Keep sits on the provider side of that line all the time. Keep notes are encrypted in transit and at rest, and Google holds the keys, so your notes are as private as Google's own policies and your account security. That's a reasonable choice for a shopping list. It's a different promise from end-to-end encryption, and the word "encrypted" covers both. + +![A table of six setups showing who holds the key, whether the company can read notes, and how account recovery works: iCloud Notes standard, iCloud Notes with Advanced Data Protection, Google Keep, Atomic Notes T2T, Atomic Notes vault, and a typical end-to-end app.](/blog/encrypted-notes-privacy/03-key-custody.png "Fig 2. Key custody decides who can read your notes. Checked October 9, 2026.") + +### 3. Metadata stays visible + +**End-to-end encryption hides what you wrote, not when, how much, or how often.** Every sync service needs some metadata to work, and it's usually readable by the provider. + +Apple publishes its list. Even with Advanced Data Protection, the dates a note was created, modified, and last viewed, whether it's pinned or deleted, and whether it contains a drawing stay under standard protection. That's honest documentation, and it's the right question to ask any app. + +![Apple's documented list of iCloud Notes metadata that stays under standard data protection even with Advanced Data Protection on: creation, modification, and last viewed dates, pinned and deleted state, whether it has a drawing, and a checksum of imported content.](/blog/encrypted-notes-privacy/04-metadata-stays.png "Fig 3. Even end-to-end encrypted notes leave a pattern. This list comes from Apple's own documentation.") + +The LastPass breach in 2022 showed why metadata matters. Attackers copied vault backups where passwords and secure notes were encrypted, but website URLs were not, along with customer names, emails, and IP addresses. The secrets stayed locked, and the map of where people had accounts didn't. My guide to [notes app metadata](/blog/notes-app-data-collection) shows what a pattern like that can reveal. + +### 4. Analytics and trackers run outside encryption + +**An app can encrypt every note and still report how you use it.** Analytics, crash reporting, and advertising SDKs collect events, device details, and timing, and none of that passes through the note encryption. + +This is the gap encryption marketing rarely mentions, because it's a different system. The question isn't "is it encrypted?" but "what else does the app send, and to whom?" Exodus Privacy scans Android apps for known tracker libraries, and an app's network permission list tells you whether it can send anything at all. + +Atomic Notes ships no analytics, crash reporting, or advertising SDKs. That's a separate choice from the vault, and it applies whether the vault is on or off. + +### 5. Account recovery and policy can reopen the lock + +**If someone can reset your way back into encrypted notes, someone holds a key.** Recovery is where convenience and privacy trade places. + +Truly end-to-end systems can't recover your notes without your password or recovery key. Systems that can, keep a copy of something that unlocks them. Policy can also move: in February 2025, Apple said it could no longer offer Advanced Data Protection to new users in the United Kingdom after a government demand, so UK users without it stayed on standard protection, with Apple holding the keys for Notes. Encryption and privacy both depend on who controls key custody, and that can be a legal question, not only a technical one. + +## How do you check encrypted notes privacy for an app? + +**Ask five questions, one per gap, and expect a plain answer to each.** Vague answers usually mean the gap is real. + +![A five-question checklist: where is it encrypted, who holds the key, what metadata stays visible, what else does the app send, and how does recovery work.](/blog/encrypted-notes-privacy/05-five-questions.png "Fig 4. Five questions that turn encryption marketing into facts.") + +1. **Where is it encrypted?** In transit only, at rest, or on your device before upload? +2. **Who holds the key?** You alone, or the provider too? +3. **What stays visible?** Look for a published metadata list. +4. **What else is sent?** Analytics, crash reports, advertising, AI features. +5. **How does recovery work?** If they can reset you back in, they can read in. + +Not sure which setup an app uses? Look it up in the key custody explorer: + +:::widget key-custody + +## Where does Atomic Notes fit? + +**It's honest about each gap, including the ones it hasn't closed.** Here's the plain version. + +![A card answering the five questions for Atomic Notes: encrypted in transit by default and on the phone with the vault, keys only on your phone with the vault, metadata named publicly, no analytics or trackers, and recovery only through your six-word phrase.](/blog/encrypted-notes-privacy/06-atomic-answers.png "Fig 5. Atomic Notes, answered the same way. The vault is optional, so the first answer depends on you.") + +| Gap | Atomic Notes | +|---|---| +| Transport | HTTPS always. With the vault off (T2T), the sync server handles note text in transit and your Drive holds readable files. | +| Key custody | With the vault on, the key comes from your six words on your phone and never leaves it. | +| Metadata | Visible to the server: each note's ID, whether it's text or a checklist, pinned and deleted state, created and updated times, and approximate size. Titles and text are sealed once the vault is on. | +| Analytics | None. No analytics, crash reporting, advertising, or AI SDKs. | +| Recovery | Only your six-word phrase. Lose it and vault notes stay locked, with no reset path. | + +There's no independent audit yet, and the vault is off by default. If your threat model includes the provider, turn it on. My [guide to encrypted notes and the vault](/blog/encrypted-notes-explained) walks through exactly how it works. + +My take: encrypted notes privacy is five answers, not one label. An app that gives you all five in plain words has earned more trust than one that just says "military-grade". + +## FAQ + +
+
+How does encryption protect privacy in a notes app? +

It makes note content unreadable to anyone without the key, whether they intercept it on a network or steal it from a server. It protects you from the company only when the key stays on your devices, which is what end-to-end encryption means.

+
+
+What is the difference between encryption and privacy? +

Encryption is a lock on content. Privacy is about who learns anything about you at all, which also covers metadata, analytics, data sharing, retention, and account recovery. Strong encryption with heavy tracking is encrypted but not private.

+
+
+Can a company read my notes if they're encrypted at rest? +

Usually, yes. Encryption at rest protects against stolen disks, but the company holds the keys so its servers can show and sync your notes. Only end-to-end encryption, with keys on your devices, keeps the provider itself out.

+
+
+Is my metadata encrypted too? +

Mostly not. Sync services need dates, sizes, and item states to work, so those usually stay readable to the provider even with end-to-end encryption. Good providers publish exactly which fields stay visible.

+
+
+Does Advanced Data Protection make Apple Notes private? +

It makes iCloud Notes content end-to-end encrypted, with keys on your trusted devices. Some metadata, like creation and modification dates and pinned or deleted state, stays under standard protection. Apple stopped offering it to new UK users in February 2025.

+
+
+Why can't an end-to-end encrypted app recover my notes? +

Because it never has the key. Recovery would need a copy of the key or a way to decrypt, and either one would let the company read your notes. That's the trade: real privacy means you hold the only way back in.

+
+
+ +## Keep reading + +- [Encrypted notes explained: T2T vs end to end encryption](/blog/encrypted-notes-explained) +- [5 best end to end encrypted notes apps](/blog/best-end-to-end-encrypted-notes-apps) +- [Notes app metadata: 8 things it knows without reading notes](/blog/notes-app-data-collection) + +
+

Atomic Notes by DevBehindYou

+

No analytics, no trackers, no AI, and a published list of every field the server keeps. Turn on the vault and the key stays on your phone. Check the code.

+
+ +## Sources + +- [iCloud data security overview. Apple Support](https://support.apple.com/en-us/102651) +- [Apple can no longer offer Advanced Data Protection in the United Kingdom to new users. Apple Support](https://support.apple.com/en-us/122234) +- [Notice of recent security incident, December 22, 2022. LastPass](https://blog.lastpass.com/posts/notice-of-recent-security-incident) +- [What Exodus Privacy does. Exodus Privacy](https://exodus-privacy.eu.org/en/page/what/) +- [Atomic Notes privacy policy](https://atomic-notes.devbehindyou.com/privacy) +- [Atomic Notes source code. GitHub](https://github.com/DevBehindYou/Atomic-Notes-App-V0.2) diff --git a/content/blog/notes-app-data-collection.md b/content/blog/notes-app-data-collection.md index ed2a8ac..0a95c5a 100644 --- a/content/blog/notes-app-data-collection.md +++ b/content/blog/notes-app-data-collection.md @@ -193,6 +193,7 @@ The catch is the same one every time: no sync means no backup and no second devi - [Encrypted notes explained: T2T vs end to end encryption](/blog/encrypted-notes-explained) - [Local first architecture: the 4 layers behind Atomic Notes](/blog/atomic-notes-architecture) - [7 note taking apps with no AI reading your notes](/blog/best-note-taking-apps-without-ai) +- [Why encryption alone does not make notes private](/blog/encrypted-notes-privacy)

Atomic Notes by DevBehindYou

diff --git a/content/blog/notes-app-privacy-mistakes.md b/content/blog/notes-app-privacy-mistakes.md index 86db096..7745f29 100644 --- a/content/blog/notes-app-privacy-mistakes.md +++ b/content/blog/notes-app-privacy-mistakes.md @@ -71,7 +71,7 @@ This is the mistake from the scene above. Plenty of notes apps offer a fingerpri Each login you add makes that note a bigger prize, and makes one stolen phone or one breached cloud account more costly. CISA's advice is short: use a password manager, and let it generate and remember unique passwords. -**Fix:** move passwords into a password manager. If a note must hold something sensitive, put it behind end to end encryption. I'll cover this one in depth in a separate guide. +**Fix:** move passwords into a password manager. If a note must hold something sensitive, put it behind end to end encryption. My guide to [storing passwords in a notes app](/blog/storing-passwords-in-notes-app) covers this one in depth. ## Mistake 4: A recovery phrase in a note that syncs @@ -203,6 +203,7 @@ My take: most notes app privacy mistakes come from treating one tool as three. A - [Notes app privacy: 9 red flags to check](/blog/notes-app-privacy-red-flags) - [Encrypted notes explained: T2T vs end to end encryption](/blog/encrypted-notes-explained) - [5 best end to end encrypted notes apps](/blog/best-end-to-end-encrypted-notes-apps) +- [Storing passwords in a notes app: 5 real dangers](/blog/storing-passwords-in-notes-app)

Atomic Notes by DevBehindYou

diff --git a/content/blog/storing-passwords-in-notes-app.md b/content/blog/storing-passwords-in-notes-app.md new file mode 100644 index 0000000..f422111 --- /dev/null +++ b/content/blog/storing-passwords-in-notes-app.md @@ -0,0 +1,207 @@ +--- +title: "Storing Passwords in Notes App: 5 Real Dangers" +slug: "storing-passwords-in-notes-app" +description: "Is it safe to store passwords in notes? Storing passwords in notes app pages turns one leak into many. Five real dangers, and how to move them out today." +excerpt: "One stolen phone or one breached account, and a note called \"logins\" hands over everything. Five dangers of keeping passwords in notes, and the fix." +author: "ashutosh-sharma" +publishedAt: "2026-10-09" +updatedAt: "2026-10-09" +category: "security" +tags: ["security", "passwords", "password-manager", "privacy", "notes-apps"] +featured: false +draft: false +coverImage: "/blog/storing-passwords-in-notes-app/01-banner.png" +coverAlt: "Cover reading Storing Passwords in a Notes App, 5 real dangers, beside a note titled logins that links to email, bank, and social accounts" +canonical: "https://atomic-notes.devbehindyou.com/blog/storing-passwords-in-notes-app" +keywords: "storing passwords in notes app, is it safe to store passwords in notes, should i keep passwords in notes, password manager, credential theft, account takeover, identity theft, reused passwords, plaintext passwords, is it safe to store passwords in google keep, is samsung notes safe for passwords, recovery email compromise, financial account security" +readingTime: "10 min read" +--- + +
+

Quick answer

+

No, it isn't safe to store passwords in notes. A notes app keeps them as plaintext passwords behind one lock, with no breach alerts, no autofill protection, and often no end-to-end encryption on the synced copy. One unlocked phone or one breached account exposes every login at once. Move them into a password manager.

+
+ +Almost everyone has one. A note called "logins", "passwords", or just "stuff", with the Wi-Fi key at the top and the bank password somewhere in the middle. + +It feels safe because it's yours and it's on your phone. That's exactly why it's dangerous. **Storing passwords in notes app** pages puts every key you own in one unguarded drawer, and that drawer usually syncs to a cloud account too. + +I build a notes app, Atomic Notes, and I'll say this plainly: it isn't a password manager, and neither is any other notes app. Here's why, what can actually go wrong, and how to move your passwords somewhere better in about twenty minutes. + +## Why is storing passwords in notes app pages so common? + +**Because it's the fastest thing that works today.** The notes app is already open, it syncs to your other phone, and search finds the password in two taps. Nobody plans the habit. It grows one login at a time. + +There are three usual starting points: + +- **A new account in a hurry.** You sign up on your phone, the site wants a password, and the notes app is one swipe away. +- **A shared household login.** The streaming service, the Wi-Fi, the router admin page. Someone asks, and a note is the easiest way to share it. +- **A password manager that felt like work.** Setting one up takes twenty minutes, and storing passwords in notes app pages takes none. + +None of these is careless. They're normal. The problem is what the note becomes after a few years: a single list of every key you own, guarded by whatever protects your notes. For most people that's a screen lock and a cloud account password, often the same password that's sitting in the note. That loop is the real reason storing passwords in notes app pages is risky, and it's the loop the rest of this guide breaks. + +## Is it safe to store passwords in notes? + +**No. A note is designed to be read, searched, synced, and shared. A password should be none of those things.** The two tools solve opposite problems. + +![A comparison of a notes app and a password manager across seven features: encrypting each secret, filling only on the matching site, breach warnings, a password generator, reuse warnings, a separate master password, and staying out of normal search.](/blog/storing-passwords-in-notes-app/03-notes-vs-manager.png "Fig 1. A notes app and a password manager, side by side. They're built for different jobs.") + +Here's what a notes app is missing for this job: + +- **Often no separate lock.** In many apps, anyone who gets past your screen lock gets the note too. +- **No phishing protection.** A password manager fills a password only on the site it belongs to. You'll paste a note's password anywhere, including a fake login page. +- **No breach alerts.** Nothing tells you when one of those passwords shows up in a leak. +- **No generator.** So the passwords in a note tend to be short and reused. +- **Search finds them.** Type "bank" into the search bar and there it is. + +So is it safe to store passwords in notes if you're careful? Careful helps. It doesn't add any of those five features. + +## The 5 dangers of storing passwords in a notes app + +**Each danger starts small and spreads, because one password usually opens the door to the next.** That chain reaction is what makes plaintext passwords in a note worse than any single weak password. + +![A diagram showing one note called logins leading to the email account, then from email to password resets for the bank, social accounts, cloud storage, and shopping accounts.](/blog/storing-passwords-in-notes-app/02-blast-radius.png "Fig 2. The blast radius of one note. Email is the account that resets all the others.") + +Try it on your own note. Tick what's in it and see how far a leak reaches: + +:::widget blast-radius + +### 1. Account takeover + +**Whoever reads the note can sign in as you.** No hacking needed. They copy, paste, and they're in. + +Credential theft is still the most common way attackers get in. Verizon's 2025 Data Breach Investigations Report found that credential abuse was the leading initial attack vector, at 22% of breaches, just ahead of exploited vulnerabilities. + +### 2. Recovery email compromise + +**Your email password is the master key.** Most account resets go to your inbox, so whoever controls it can reset the bank, the social accounts, and the cloud storage one by one. + +This is the step that turns one leaked note into a full account takeover. If your email password sits in that note, the note is effectively the password to everything. + +### 3. Financial account security breaks down + +**Bank, card, and payment app logins are the reason people steal these notes.** Even with two-step verification, a note that holds the password and the security answers makes social engineering far easier. + +Security questions are the quiet risk here. If your note holds "mother's maiden name" and "first pet", those answers work on the phone with your bank too. + +### 4. Reused passwords spread the damage + +**A password in a note is usually a password you reuse.** People write things down because they're hard to remember, then use the same one everywhere so they only need to remember one note. + +Attackers test leaked email and password pairs across hundreds of sites automatically. One leak from a shopping site, plus a reused password, equals access to accounts you forgot you had. + +### 5. Identity theft + +**Notes with passwords often hold more: ID numbers, addresses, card details, and security answers.** Together they're enough to open accounts in your name, not just break into existing ones. + +You can change a password in a minute. You can't change your date of birth or your national ID number, which is why identity theft takes years to clean up. + +## Is it safe to store passwords in Google Keep or Samsung Notes? + +**Neither is a password manager, though the risks differ.** Here's the honest picture for the apps people ask about most. + +![A table of four notes apps showing whether each has a note lock, end-to-end encryption for synced notes, breach alerts, and autofill, all compared with a password manager.](/blog/storing-passwords-in-notes-app/04-apps-compared.png "Fig 3. Popular notes apps compared for password storage. None replaces a password manager.") + +- **Google Keep.** So, is it safe to store passwords in Google Keep? Keep has no lock for individual notes, and Keep notes aren't end-to-end encrypted. Your passwords are as safe as your Google account and your unlocked phone. +- **Samsung Notes.** Is Samsung Notes safe for passwords? It can lock a note with a password or your fingerprint, which helps against someone holding your phone. A lock isn't breach alerts, autofill, or a generator, though. +- **Apple Notes.** You can lock notes with your device passcode. Regular synced iCloud notes are end-to-end encrypted only if you turn on Advanced Data Protection. +- **Atomic Notes.** It has an app lock and an optional end-to-end vault. Neither makes it a password manager, and I'd rather you didn't use it as one. + +A locked note is better than an unlocked one. It's still a note. + +## What should you use instead of a notes app? + +**A password manager, protected by one strong passphrase and two-step verification.** It generates unique passwords, fills them only on the right site, and warns you when one leaks. + +Should I keep passwords in notes even for a week while I set one up? If you must, keep them short-lived and behind an end-to-end encrypted vault, then delete the note the moment they're moved. CISA's guidance is short: let a password manager create and store long, unique passwords for every account. + +Before you move anything, check whether any of your passwords already appear in known breaches. This command uses the Pwned Passwords range API. Only the first five characters of the password's SHA-1 hash leave your computer: + +

Terminal · check one password against known breaches

+ +```bash +read -rs PW # type the password, nothing is shown or saved to history +HASH=$(printf '%s' "$PW" | sha1sum | cut -c1-40 | tr 'a-f' 'A-F'); unset PW +curl -s "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep -i "${HASH:5}" \ + || echo "Not found in known breaches" +# A match prints SUFFIX:COUNT. For "password123" the count is over 2 million. +``` + +Any password that matches goes to the top of your change list. + +## How do you move passwords out of your notes today? + +**Five steps, about twenty minutes for most people, and then you're done storing passwords in notes app pages for good.** Start with the accounts that can reset other accounts. + +![Five steps: install a password manager, move your email password first and change it, move bank and phone carrier logins next, turn on two-step verification, then delete the note and empty the trash.](/blog/storing-passwords-in-notes-app/05-move-out.png "Fig 4. Moving out, in order of blast radius. Email first.") + +1. **Pick a password manager** and protect it with a long passphrase you've never used anywhere else. +2. **Move your email password first, and change it** while you're there. Email resets everything else. +3. **Move the bank, phone carrier, and cloud storage logins next.** These are the accounts attackers use for money and for SIM swaps. +4. **Turn on two-step verification** on those same accounts, ideally with an authenticator app or a passkey. +5. **Delete the note, then empty the notes app's trash or recycle bin.** A deleted note often lives on for 30 days. + +Not sure what else is hiding in your notes? Paste a note below. The scanner runs only in your browser and flags things that look like passwords, recovery phrases, or card numbers: + +:::widget secret-scanner + +## Where does Atomic Notes fit? + +**It's a notes app, and it should stay one.** The vault is for private writing, not for credentials. + +![The Atomic Notes vault screen on a phone, beside a card: an optional end-to-end vault and app lock for private notes, but no autofill, no breach alerts, and no password generator, so it is not a password manager.](/blog/storing-passwords-in-notes-app/06-atomic-notes-card.png "Fig 5. Atomic Notes, honestly: good for private notes, wrong tool for passwords.") + +Atomic Notes has a biometric app lock and an optional end-to-end vault, sealed with AES-256-GCM behind a six-word phrase. That protects a journal or a medical note well. It doesn't fill passwords on the right site, warn you about breaches, or generate anything, and those are the things that actually stop account takeover. My take: use the right tool for each job, and keep your notes app for notes. + +My guide to [ten notes app privacy mistakes](/blog/notes-app-privacy-mistakes) covers the other habits worth fixing while you're at it. + +## FAQ + +
+
+Is it safe to keep a passwords note on my phone? +

No. Anyone past your screen lock can read them, search finds them instantly, and synced copies usually aren't end-to-end encrypted. A notes app also can't warn you about breaches or stop you pasting a password into a fake login page.

+
+
+Should I keep passwords in notes if the note is locked? +

A locked note is better than an open one, but it still lacks breach alerts, a generator, and site-matched autofill. Use the lock as a short-term stopgap while you move everything into a password manager, then delete the note.

+
+
+Is it safe to store passwords in Google Keep? +

Not really. Keep has no lock for individual notes, and its notes aren't end-to-end encrypted, so they're only as safe as your Google account and your unlocked phone. A password manager is the safer home.

+
+
+Is Samsung Notes safe for passwords? +

Safer than an unlocked note, because Samsung Notes can lock a note with a password or fingerprint. It still has no breach alerts, generator, or phishing-resistant autofill, so treat the lock as a temporary measure, not a password manager.

+
+
+What is the biggest danger of storing passwords in notes app pages? +

Your email password. Most accounts reset through your inbox, so anyone who reads that one line can take over everything else in turn. Move it first, change it, and turn on two-step verification.

+
+
+Can I use Atomic Notes as a password manager? +

Please don't. Its vault encrypts private notes well, but it has no autofill, breach alerts, or password generator, which are the features that prevent account takeover. Use a dedicated password manager for credentials and Atomic Notes for everything else.

+
+
+ +## Keep reading + +- [Notes app security: 10 privacy mistakes to fix](/blog/notes-app-privacy-mistakes) +- [5 best end to end encrypted notes apps](/blog/best-end-to-end-encrypted-notes-apps) +- [Encrypted notes explained: T2T vs end to end encryption](/blog/encrypted-notes-explained) + +
+

Atomic Notes by DevBehindYou

+

For the private writing that isn't a password: journals, health notes, plans. Your phone first, your own Google Drive second, and an optional end-to-end vault. See how it works.

+
+ +## Sources + +- [2025 Data Breach Investigations Report. Verizon](https://www.verizon.com/about/news/2025-data-breach-investigations-report) +- [Use strong passwords. CISA](https://www.cisa.gov/secure-our-world/use-strong-passwords) +- [Turn on multifactor authentication. CISA](https://www.cisa.gov/secure-our-world/turn-mfa) +- [Credential stuffing. OWASP](https://owasp.org/www-community/attacks/Credential_stuffing) +- [Pwned Passwords API. Have I Been Pwned](https://haveibeenpwned.com/API/v3#PwnedPasswords) +- [iCloud data security overview. Apple Support](https://support.apple.com/en-us/102651) +- [Google Keep is missing basic features. Android Police](https://www.androidpolice.com/google-keep-missing-features-annoy-me/) +- [Secure your Samsung Notes documents with a fingerprint or password. SamMobile](https://www.sammobile.com/news/secure-your-samsung-notes-documents-with-a-fingerprint-or-password/) diff --git a/content/blog/switch-notes-app.md b/content/blog/switch-notes-app.md new file mode 100644 index 0000000..1cdb29c --- /dev/null +++ b/content/blog/switch-notes-app.md @@ -0,0 +1,236 @@ +--- +title: "Switch Notes App Safely: 7 Checks Before You Move" +slug: "switch-notes-app" +description: "Want to switch notes app without losing anything? Seven checks before you migrate notes to a new app, how popular apps export, and a step-by-step plan." +excerpt: "Exports drop attachments, encrypted notes stay locked, and services shut down. Seven checks and a plan to move notes to another app with nothing lost." +author: "ashutosh-sharma" +publishedAt: "2026-10-09" +updatedAt: "2026-10-09" +category: "local-first" +tags: ["migration", "export", "notes-apps", "backup", "data-ownership"] +featured: false +draft: false +coverImage: "/blog/switch-notes-app/01-banner.png" +coverAlt: "Cover reading Switch Notes App Safely, beside a checklist of seven checks from export format to shutdown risk" +canonical: "https://atomic-notes.devbehindyou.com/blog/switch-notes-app" +keywords: "switch notes app, migrate notes to a new app, move notes to another app, notes migration, data export, export format, attachments, note counts, rollback copy, account recovery, offline notes, cloud storage provider, secure data migration" +readingTime: "11 min read" +--- + +
+

Quick answer

+

Before you switch notes app, check seven things: the export format, attachments, encryption, account recovery, offline access, where the new app stores notes, and what happens if it shuts down. Then move in order: export, keep an untouched rollback copy, import, compare note counts, and run both apps side by side for two weeks.

+
+ +Switching notes apps feels like a weekend job. Export, import, done. Then a month later you go looking for a recipe, a scanned receipt, or a checklist from last spring, and it isn't there. + +Most notes go missing during a move because nobody checked what the export left out. Attachments stay behind. Checklists turn into plain text. Encrypted notes come out as gibberish. Folder structure flattens. + +So before you **switch notes app**, run seven checks, then follow a plan with a way back. I build Atomic Notes, and its own section near the end is blunt about how hard it is to move into and out of it today. + +## Why do notes get lost when you switch apps? + +**Because every app's export is a translation, and translations drop things.** The new app imports what it understands and quietly skips the rest. + +![Seven check cards: export format, attachments, encryption, account recovery, offline notes, cloud storage provider, and shutdown risk.](/blog/switch-notes-app/02-seven-checks.png "Fig 1. Seven checks before any notes migration. Each one has cost someone their notes.") + +The common losses are predictable: + +- **Attachments.** Images, PDFs, and audio often export as separate files the new app doesn't link back. +- **Structure.** Notebooks, tags, and nested folders flatten into one long list. +- **Checklists.** Ticked items can turn into plain text with no state. +- **Dates.** Imported notes often get today's date, which breaks sorting and search. +- **Encrypted notes.** They export as ciphertext, or not at all, unless you unlock them first. + +None of these show up until you need the missing note. That's why the plan below ends with counting, not importing. + +## The 7 things to check before you switch notes app + +**Check the old app's way out and the new app's way out before you commit.** The app you're joining today is the app you'll eventually leave. + +Run through them for the move you're planning: + +:::widget switch-check + +### 1. The export format + +**Plain text, Markdown, HTML, or JSON travel well. A proprietary file only the old app reads doesn't.** Look for a full export, not a share-one-note option. + +A good data export gives you every note in one go, in a documented format, with dates and tags. Markdown is the most portable for text. JSON keeps the most detail. + +### 2. Attachments + +**Ask what happens to images, PDFs, and audio.** Some exports include them in a folder. Some leave links that break the day your old account closes. + +Count your attachments before you move. If the new app can't hold them, keep them in a plain folder next to your notes. + +### 3. Encryption on the way out + +**End-to-end encrypted notes have to be decrypted somewhere to move.** Do it on your own device, unlock the vault, export, and delete that plain copy when you're done. + +This is secure data migration in one sentence: the readable copy should only ever exist on hardware you own, for as long as the move takes. + +### 4. Account recovery in the new app + +**Know how you get back in before you put years of notes inside.** A provider that can reset your password can also read your notes. One that can't will lose them if you lose the key. + +Write down the recovery key or phrase the new app gives you, on paper, before the import. + +### 5. Offline notes + +**Turn on airplane mode and open the new app.** Offline notes that load from the device are a sign the app keeps a real copy with you, not just a cache. + +My guide to [notes apps that work without internet](/blog/why-notes-should-work-offline) has a five-minute test you can run on any app. + +### 6. The cloud storage provider + +**Where will the synced copy live, and who can read it?** The company's servers, a cloud you already pay for, or a server you run yourself are three different trust decisions. + +If you want local first note taking with a copy you own, my comparison of [local first note taking apps](/blog/best-local-first-note-taking-apps) sorts the options by exactly this. + +### 7. Shutdown risk + +**Services end, and they don't always give much notice.** Ask what you'd still have the day after an announcement. + +Pocket is a recent example. Mozilla shut it down on July 8, 2025, moved it to export-only, and set October 8, 2025 as the date after which accounts and data would be permanently deleted. People who exported early lost nothing. People who missed the window lost everything. + +## How do popular apps export notes? + +**Every big notes app has an export, but each one leaves something out.** Here's what you get from the apps people most often leave. + +![A table of six apps showing how to export, the format you get, and what to watch: Google Keep through Google Takeout, Apple Notes as Markdown, Evernote as ENEX or HTML, Notion as Markdown and CSV, Obsidian as files already, and Atomic Notes as JSON files in Drive.](/blog/switch-notes-app/03-export-formats.png "Fig 2. Export formats from popular notes apps. Checked October 9, 2026.") + +| App | How to export | What you get | +|---|---|---| +| Google Keep | Google Takeout | Each note as an HTML file and a JSON file, with attachments | +| Apple Notes | Export as Markdown (iOS 26, macOS Tahoe) | Markdown files with images, without folder structure | +| Evernote | Desktop app only, up to 100 notes at a time or whole notebooks | ENEX or HTML files | +| Notion | Settings or page menu | Markdown and CSV, HTML, or PDF | +| Obsidian | Nothing to export | Your vault is already a folder of Markdown files | +| Atomic Notes | No export button yet | One JSON file per note in your own Google Drive | + +The export format decides how much work the import will be. Markdown and plain files move to almost anything. ENEX and Notion's CSV databases need an importer on the other side. + +## How do you migrate notes to a new app without losing anything? + +**Export, freeze a copy, import, count, then wait.** The waiting is the part people skip, and it's the part that catches missing notes. + +![Six steps: export everything, keep an untouched rollback copy, import into the new app, compare note and attachment counts, use both apps for two weeks, then retire the old account.](/blog/switch-notes-app/04-migration-plan.png "Fig 3. A migration plan with a way back. The rollback copy is never opened, only kept.") + +1. **Export everything** from the old app, including attachments. +2. **Keep a rollback copy.** Zip the export, put it on a USB drive or a second cloud, and don't touch it. +3. **Import into the new app** from a separate copy, never from the rollback copy. +4. **Compare note counts.** Count notes, checklists, and attachments before and after. +5. **Use both for two weeks.** Search the new app for things you know exist. +6. **Retire the old account** only when nothing has come up missing. + +Count your notes with the checker below. It flags any gap: + +:::widget count-check + +When you move notes to another app this way, a missing note shows up in step 4 or 5, while the old account still exists to recover it from. + +## What does a safe switch look like over time? + +**Give the old app a few weeks of overlap before you delete anything, however tempting it is to switch notes app in one evening.** The rollback copy is your insurance after that. + +![A timeline: day 0 export and rollback copy, day 1 import and count, days 2 to 14 both apps in use, day 15 old account closed, and the rollback copy kept for at least a year.](/blog/switch-notes-app/05-timeline.png "Fig 4. A two-week overlap, and a rollback copy kept for a year.") + +Two weeks is enough for most people to hit the notes they use weekly: a shopping list, a work log, a recipe. Notes you open once a year, like a tax checklist or a warranty receipt, won't come up in that window, which is why the rollback copy stays for a year. + +Store that copy like any other sensitive file. If your old notes were end-to-end encrypted, the export is now plain text, so put it in an encrypted archive or on a drive you keep at home, not in a shared cloud folder. + +When you switch notes app on a phone, also check the small things the export never carries: home screen widgets, reminders, share links you sent people, and any app lock you set. Rebuild those by hand in the new app on day one, so the first week feels normal and you don't drift back to the old one. + +One last habit: write down where everything went. A short note in the new app, "moved from X on this date, rollback copy on the blue USB drive", saves real panic a year from now. + +## Can you switch to or from Atomic Notes? + +**Yes, but not with one button yet, and I'd rather you knew that before you start.** Atomic Notes has no import tool and no export button today. + +![A card about moving with Atomic Notes: notes live as JSON files in your own Google Drive, plain notes convert with a short script, vault notes stay encrypted, and there is no import or export button yet.](/blog/switch-notes-app/06-atomic-notes-card.png "Fig 5. Atomic Notes, honestly: your files are yours, but the tools to move them are still coming.") + +Getting notes in means typing or pasting them, one by one. Getting notes out is easier than it sounds, because every synced note is already a file in a `My-Atomic-Notes` folder in your own Google Drive. Download that folder, and this short script turns plain notes into Markdown files any app can import: + +

atomic_to_md.py · run next to the downloaded My-Atomic-Notes folder

+ +```python +import json, pathlib, re + +src = pathlib.Path("My-Atomic-Notes") # the folder you downloaded from Google Drive +out = pathlib.Path("markdown"); out.mkdir(exist_ok=True) +sealed = 0 +for f in sorted(src.glob("*.atomic")): + note = json.loads(f.read_text(encoding="utf-8")) + if note.get("encV", 0) >= 1: # vault note: ciphertext, only the app can open it + sealed += 1 + continue + title = note["title"] or note["id"] + lines = [f"# {title}", ""] + if note["kind"] == "todo": + for i in note["items"]: # older files may use t/d instead of text/done + done, text = i.get("done", i.get("d")), i.get("text", i.get("t", "")) + lines.append(f"- [{'x' if done else ' '}] {text}") + else: + lines.append(note["body"]) + name = re.sub(r'[\\/:*?"<>|]', "-", title)[:80] + path = out / f"{name}.md" + if path.exists(): + path = out / f"{name} {note['id'][:8]}.md" + path.write_text("\n".join(lines) + "\n", encoding="utf-8") +print(f"Done. {sealed} vault notes skipped.") +``` + +Two honest limits. Vault notes are ciphertext in those files, so the script skips them, and only the app with your six-word phrase can open them. A real export button is planned, and this guide will be updated when it ships. + +My take: the best time to plan your exit from a notes app is the day you join it. An app that makes leaving easy has nothing to hide, and I'm holding my own app to that standard. + +## FAQ + +
+
+How do I switch notes app without losing notes? +

Export everything, keep an untouched rollback copy somewhere else, import from a separate copy, and compare note and attachment counts. Then use both apps for two weeks before closing the old account, so anything missing still has somewhere to come from.

+
+
+What is the best format to migrate notes to a new app? +

Markdown for text, because almost every notes app imports it and any editor can open it. JSON keeps the most detail, such as dates and checklist state. Proprietary formats like ENEX need an importer that understands them.

+
+
+How do I move notes to another app if they're encrypted? +

Unlock them in the old app on your own device, export, import into the new app, then delete the plain export. Exports of locked end-to-end encrypted notes are usually unreadable anywhere else, so do this before you close the old account.

+
+
+Do attachments survive a notes migration? +

Often not completely. Some exports put attachments in a separate folder the new app doesn't link back to notes. Count them before and after, and keep the original attachment folder with your rollback copy.

+
+
+What should I do if my notes app is shutting down? +

Export immediately, not at the deadline. Shutdowns often move to export-only mode and then delete everything on a fixed date, as Pocket did in 2025. Keep the export in two places, then pick a new app using the seven checks above.

+
+
+Can I export my notes from Atomic Notes? +

There's no export button yet. Every synced note is a JSON file in your own Google Drive, so you can download the folder and convert plain notes to Markdown with a short script. Vault notes stay encrypted and need the app to open.

+
+
+ +## Keep reading + +- [6 best local first note taking apps](/blog/best-local-first-note-taking-apps) +- [Notes app security: 10 privacy mistakes to fix](/blog/notes-app-privacy-mistakes) +- [What is a local first notes app?](/blog/what-is-a-local-first-notes-app) + +
+

Atomic Notes by DevBehindYou

+

Your notes live on your phone and in your own Google Drive as plain JSON files you can always download. No lock-in by format, no ads, and no AI. See how it works.

+
+ +## Sources + +- [Pocket is saying goodbye: what you need to know. Mozilla Support](https://support.mozilla.org/en-US/kb/future-of-pocket) +- [How to download your Google data. Google Account Help](https://support.google.com/accounts/answer/3024190?hl=en) +- [Import and export Markdown files in Apple Notes. MacRumors](https://www.macrumors.com/how-to/ios-import-export-markdown-apple-notes/) +- [Export notes and notebooks as ENEX or HTML. Evernote Help](https://help.evernote.com/hc/en-us/articles/209005557-Export-notes-and-notebooks-as-ENEX-or-HTML) +- [Export your content. Notion Help](https://www.notion.com/help/export-your-content) +- [Right to data portability, GDPR Article 20](https://gdpr-info.eu/art-20-gdpr/) +- [Atomic Notes source code. GitHub](https://github.com/DevBehindYou/Atomic-Notes-App-V0.2) diff --git a/public/blog/encrypted-notes-privacy/01-banner.png b/public/blog/encrypted-notes-privacy/01-banner.png new file mode 100644 index 0000000..c955aae Binary files /dev/null and b/public/blog/encrypted-notes-privacy/01-banner.png differ diff --git a/public/blog/encrypted-notes-privacy/02-five-gaps.png b/public/blog/encrypted-notes-privacy/02-five-gaps.png new file mode 100644 index 0000000..6132f4e Binary files /dev/null and b/public/blog/encrypted-notes-privacy/02-five-gaps.png differ diff --git a/public/blog/encrypted-notes-privacy/03-key-custody.png b/public/blog/encrypted-notes-privacy/03-key-custody.png new file mode 100644 index 0000000..46e5763 Binary files /dev/null and b/public/blog/encrypted-notes-privacy/03-key-custody.png differ diff --git a/public/blog/encrypted-notes-privacy/04-metadata-stays.png b/public/blog/encrypted-notes-privacy/04-metadata-stays.png new file mode 100644 index 0000000..f259a23 Binary files /dev/null and b/public/blog/encrypted-notes-privacy/04-metadata-stays.png differ diff --git a/public/blog/encrypted-notes-privacy/05-five-questions.png b/public/blog/encrypted-notes-privacy/05-five-questions.png new file mode 100644 index 0000000..57873cd Binary files /dev/null and b/public/blog/encrypted-notes-privacy/05-five-questions.png differ diff --git a/public/blog/encrypted-notes-privacy/06-atomic-answers.png b/public/blog/encrypted-notes-privacy/06-atomic-answers.png new file mode 100644 index 0000000..d19c7a7 Binary files /dev/null and b/public/blog/encrypted-notes-privacy/06-atomic-answers.png differ diff --git a/public/blog/storing-passwords-in-notes-app/01-banner.png b/public/blog/storing-passwords-in-notes-app/01-banner.png new file mode 100644 index 0000000..f7dd4c3 Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/01-banner.png differ diff --git a/public/blog/storing-passwords-in-notes-app/02-blast-radius.png b/public/blog/storing-passwords-in-notes-app/02-blast-radius.png new file mode 100644 index 0000000..b7d1abc Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/02-blast-radius.png differ diff --git a/public/blog/storing-passwords-in-notes-app/03-notes-vs-manager.png b/public/blog/storing-passwords-in-notes-app/03-notes-vs-manager.png new file mode 100644 index 0000000..17a0f5b Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/03-notes-vs-manager.png differ diff --git a/public/blog/storing-passwords-in-notes-app/04-apps-compared.png b/public/blog/storing-passwords-in-notes-app/04-apps-compared.png new file mode 100644 index 0000000..6c9b602 Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/04-apps-compared.png differ diff --git a/public/blog/storing-passwords-in-notes-app/05-move-out.png b/public/blog/storing-passwords-in-notes-app/05-move-out.png new file mode 100644 index 0000000..48f3a58 Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/05-move-out.png differ diff --git a/public/blog/storing-passwords-in-notes-app/06-atomic-notes-card.png b/public/blog/storing-passwords-in-notes-app/06-atomic-notes-card.png new file mode 100644 index 0000000..73b0132 Binary files /dev/null and b/public/blog/storing-passwords-in-notes-app/06-atomic-notes-card.png differ diff --git a/public/blog/switch-notes-app/01-banner.png b/public/blog/switch-notes-app/01-banner.png new file mode 100644 index 0000000..4b5fea5 Binary files /dev/null and b/public/blog/switch-notes-app/01-banner.png differ diff --git a/public/blog/switch-notes-app/02-seven-checks.png b/public/blog/switch-notes-app/02-seven-checks.png new file mode 100644 index 0000000..34e4031 Binary files /dev/null and b/public/blog/switch-notes-app/02-seven-checks.png differ diff --git a/public/blog/switch-notes-app/03-export-formats.png b/public/blog/switch-notes-app/03-export-formats.png new file mode 100644 index 0000000..f882a42 Binary files /dev/null and b/public/blog/switch-notes-app/03-export-formats.png differ diff --git a/public/blog/switch-notes-app/04-migration-plan.png b/public/blog/switch-notes-app/04-migration-plan.png new file mode 100644 index 0000000..9747c26 Binary files /dev/null and b/public/blog/switch-notes-app/04-migration-plan.png differ diff --git a/public/blog/switch-notes-app/05-timeline.png b/public/blog/switch-notes-app/05-timeline.png new file mode 100644 index 0000000..05876f1 Binary files /dev/null and b/public/blog/switch-notes-app/05-timeline.png differ diff --git a/public/blog/switch-notes-app/06-atomic-notes-card.png b/public/blog/switch-notes-app/06-atomic-notes-card.png new file mode 100644 index 0000000..85a990a Binary files /dev/null and b/public/blog/switch-notes-app/06-atomic-notes-card.png differ diff --git a/public/llms.txt b/public/llms.txt index dfedab4..4e129a8 100644 --- a/public/llms.txt +++ b/public/llms.txt @@ -34,6 +34,9 @@ Key facts: - [8 Best Offline Notes Apps for Android in 2026](https://atomic-notes.devbehindyou.com/blog/best-offline-notes-apps-android): Atomic Notes, Material Notes, Open Notes, sNotz, Easy Notes, Orgzly Revived, Notes, and Butterfly, checked for internet permission, account, sync, and backups - [7 Best Note Taking Apps Without AI in 2026](https://atomic-notes.devbehindyou.com/blog/best-note-taking-apps-without-ai): Atomic Notes, Markor, TiddlyWiki, Zim, Saber, Dynalist, and CherryTree, plus Notion alternatives without AI and how to check an app for AI - [Notes App Security: 10 Privacy Mistakes to Fix in 2026](https://atomic-notes.devbehindyou.com/blog/notes-app-privacy-mistakes): ten everyday habits that weaken notes app security (locks, secrets, share links, cloud accounts, exports, APKs) and a fix for each +- [Storing Passwords in Notes App: 5 Real Dangers](https://atomic-notes.devbehindyou.com/blog/storing-passwords-in-notes-app): why a notes app is not a password manager, Google Keep and Samsung Notes for passwords, a breach check, and how to move passwords out +- [How Does Encryption Protect Privacy? 5 Gaps in Your Notes](https://atomic-notes.devbehindyou.com/blog/encrypted-notes-privacy): transport encryption, key custody (iCloud Advanced Data Protection, Google Keep, Atomic Notes), metadata, analytics, and account recovery +- [Switch Notes App Safely: 7 Checks Before You Move](https://atomic-notes.devbehindyou.com/blog/switch-notes-app): export formats of popular notes apps, a migration plan with a rollback copy, and how to get notes out of Atomic Notes today - [Atomic Notes v1.18.2 Demo Build](https://atomic-notes.devbehindyou.com/blog/atomic-notes-v1-18-2): Atomic Energy, in-app email flows, notification center, offline launch fix - [RSS feed](https://atomic-notes.devbehindyou.com/feed.xml) and [sitemap](https://atomic-notes.devbehindyou.com/sitemap.xml): every published page and post diff --git a/src/components/blog/BlastRadius.tsx b/src/components/blog/BlastRadius.tsx new file mode 100644 index 0000000..57ae653 --- /dev/null +++ b/src/components/blog/BlastRadius.tsx @@ -0,0 +1,51 @@ +"use client"; + +import { useState } from "react"; + +// What a leaked "logins" note can unlock. Email resets most other accounts, so it multiplies the reach. +// An illustrative model of typical account recovery, not a description of any one service. + +const ITEMS = [ + { id: "email", label: "Email password", reach: ["Reset almost any other account", "Read every reset link and code sent to you"] }, + { id: "bank", label: "Bank or card login", reach: ["See balances and statements", "Try transfers, with help from your security answers"] }, + { id: "carrier", label: "Phone carrier login", reach: ["Request a SIM swap", "Receive your text message codes"] }, + { id: "social", label: "Social media", reach: ["Message your contacts as you", "Scam friends and family"] }, + { id: "cloud", label: "Cloud storage", reach: ["Download your photos and documents", "Find more personal data"] }, + { id: "answers", label: "Security answers", reach: ["Pass phone verification with support lines", "Reset accounts that still use questions"] }, + { id: "id", label: "ID or tax numbers", reach: ["Open new accounts in your name"] }, +]; + +export function BlastRadius() { + const [on, setOn] = useState(["email"]); + const toggle = (id: string) => setOn((s) => (s.includes(id) ? s.filter((x) => x !== id) : [...s, id])); + const hits = ITEMS.filter((i) => on.includes(i.id)); + const reach = hits.flatMap((i) => i.reach); + const viaEmail = on.includes("email") ? ITEMS.filter((i) => !on.includes(i.id) && ["bank", "social", "cloud"].includes(i.id)).map((i) => i.label) : []; + const level = on.includes("email") || on.length >= 3 ? "high" : on.length ? "mid" : ""; + + return ( +
+

TRY IT · THE BLAST RADIUS

+

Your logins note leaks. How far does it reach?

+

Tick what's written in your note today.

+
+ {ITEMS.map((i) => ( + + ))} +
+ +
+

SOMEONE WITH THIS NOTE CAN

+ {reach.length === 0 ? ( +

Nothing ticked. Keep it that way.

+ ) : ( +
    + {reach.map((r) => (
  • {r}
    • ))} + {viaEmail.length > 0 &&
  • Through your email: reset {viaEmail.join(", ").toLowerCase()}, even though they aren't in the note.
    • } +
+ )} +
+

A typical picture of how account recovery works. Two-step verification on each account cuts this down a lot.

+
+ ); +} diff --git a/src/components/blog/BlogWidget.tsx b/src/components/blog/BlogWidget.tsx index 9ba341a..553f3dc 100644 --- a/src/components/blog/BlogWidget.tsx +++ b/src/components/blog/BlogWidget.tsx @@ -21,6 +21,12 @@ import { AiScanner } from "./AiScanner"; import { AiPath } from "./AiPath"; import { HabitAudit } from "./HabitAudit"; import { ApkChecker } from "./ApkChecker"; +import { BlastRadius } from "./BlastRadius"; +import { SecretScanner } from "./SecretScanner"; +import { ThreatMatrix } from "./ThreatMatrix"; +import { KeyCustody } from "./KeyCustody"; +import { SwitchCheck } from "./SwitchCheck"; +import { CountCheck } from "./CountCheck"; // Interactive components a post can place with `:::widget ` on its own line. const WIDGETS: Record React.ReactElement> = { @@ -45,6 +51,12 @@ const WIDGETS: Record React.ReactElement> = { "ai-path": AiPath, "habit-audit": HabitAudit, "apk-checker": ApkChecker, + "blast-radius": BlastRadius, + "secret-scanner": SecretScanner, + "threat-matrix": ThreatMatrix, + "key-custody": KeyCustody, + "switch-check": SwitchCheck, + "count-check": CountCheck, }; export const WIDGET_NAMES = Object.keys(WIDGETS); diff --git a/src/components/blog/CountCheck.tsx b/src/components/blog/CountCheck.tsx new file mode 100644 index 0000000..e806784 --- /dev/null +++ b/src/components/blog/CountCheck.tsx @@ -0,0 +1,59 @@ +"use client"; + +import { useState } from "react"; + +// Compares item counts before and after a notes migration and flags any gap. + +const ROWS = [ + { id: "notes", label: "Notes" }, + { id: "checklists", label: "Checklists" }, + { id: "attachments", label: "Attachments" }, + { id: "folders", label: "Notebooks or folders" }, +]; + +type Counts = Record; + +export function CountCheck() { + const [c, setC] = useState(Object.fromEntries(ROWS.map((r) => [r.id, { before: "", after: "" }]))); + const set = (id: string, k: "before" | "after", v: string) => setC((s) => ({ ...s, [id]: { ...s[id], [k]: v.replace(/[^\d]/g, "").slice(0, 6) } })); + const results = ROWS.map((r) => { + const b = c[r.id].before, a = c[r.id].after; + if (b === "" || a === "") return { ...r, state: "wait" as const, diff: 0 }; + const diff = Number(a) - Number(b); + return { ...r, state: diff === 0 ? ("ok" as const) : ("bad" as const), diff }; + }); + const filled = results.filter((r) => r.state !== "wait"); + const bad = results.filter((r) => r.state === "bad"); + + return ( +
+

STEP 4 · COUNT CHECK

+

Did everything make it across?

+

Type the counts from the old app and the new one. Any gap gets flagged.

+
+ + + + {results.map((r) => ( + + + {(["before", "after"] as const).map((k) => ( + + ))} + + + ))} + +
ITEMOLD APPNEW APPRESULT
{r.label} + set(r.id, k, e.target.value)} + style={{ width: 72, font: "inherit", padding: "6px 8px", border: "2px solid var(--ink)", borderRadius: 4, background: "#fff", color: "var(--ink)" }} /> + {r.state === "wait" ? "..." : r.state === "ok" ? "MATCH" : `${r.diff > 0 ? "+" : ""}${r.diff}`}
+
+

+ {filled.length - bad.length} / {ROWS.length} + {filled.length === 0 ? "Fill in a row to compare." : bad.length ? `Gap in ${bad.map((b) => b.label.toLowerCase()).join(", ")}. Find what's missing before you close the old account.` : "Everything you've counted matches."} +

+

A higher count in the new app can mean duplicates or split notes. Check those too.

+
+ ); +} diff --git a/src/components/blog/KeyCustody.tsx b/src/components/blog/KeyCustody.tsx new file mode 100644 index 0000000..f75c9f4 --- /dev/null +++ b/src/components/blog/KeyCustody.tsx @@ -0,0 +1,43 @@ +"use client"; + +import { useState } from "react"; + +// Key custody for common notes setups, from each provider's own documentation (October 9, 2026). + +const SETUPS = [ + { name: "iCloud Notes, standard", key: "Apple", read: "Yes. Apple holds the keys for Notes under standard data protection.", meta: "Not documented separately, since content isn't end-to-end encrypted.", recovery: "Apple can help you back into your account and your notes." }, + { name: "iCloud Notes, Advanced Data Protection", key: "Your trusted devices", read: "No. Notes content is end-to-end encrypted.", meta: "Created, modified, and viewed dates, pinned and deleted state, and drawing flags stay under standard protection.", recovery: "A recovery contact or recovery key you set up. Not offered to new UK users since February 2025." }, + { name: "Google Keep", key: "Google", read: "Yes. Keep isn't end-to-end encrypted.", meta: "Everything the service stores is under Google's keys.", recovery: "Google account recovery restores your notes." }, + { name: "Atomic Notes, T2T (default)", key: "No note key. Google holds your Drive's keys", read: "The sync server handles text in transit but doesn't store it. Your Drive holds readable files.", meta: "Note ID, type, pinned and deleted state, timestamps, and rough size.", recovery: "Sign in with Google. Your Drive files and phone copy remain." }, + { name: "Atomic Notes, vault on", key: "Your phone, from your six words", read: "No. Only ciphertext leaves the phone.", meta: "Note ID, type, pinned and deleted state, timestamps, and rough size.", recovery: "Only your six-word phrase. No reset path exists." }, +]; + +export function KeyCustody() { + const [i, setI] = useState(1); + const x = SETUPS[i]; + return ( +
+

LOOK IT UP · KEY CUSTODY

+

Who holds the key?

+

Pick a setup to see who can read your notes, what stays visible, and how recovery works.

+
+
+ {SETUPS.map((s, j) => ( + + ))} +
+
+

KEY HELD BY

+

{x.key}

+

CAN THE PROVIDER READ NOTES?

+

{x.read}

+

STILL VISIBLE

+

{x.meta}

+

RECOVERY

+

{x.recovery}

+
+
+

From Apple, Google, and Atomic Notes documentation, checked October 9, 2026.

+
+ ); +} diff --git a/src/components/blog/SecretScanner.tsx b/src/components/blog/SecretScanner.tsx new file mode 100644 index 0000000..df2e1c2 --- /dev/null +++ b/src/components/blog/SecretScanner.tsx @@ -0,0 +1,69 @@ +"use client"; + +import { useMemo, useState } from "react"; + +// Flags text that looks like a secret: password lines, recovery phrases, card numbers, backup codes. +// Runs only in the browser. Heuristics, so it can miss things and flag harmless lines. + +function luhn(d: string) { + let s = 0, alt = false; + for (let i = d.length - 1; i >= 0; i--) { let n = +d[i]; if (alt) { n *= 2; if (n > 9) n -= 9; } s += n; alt = !alt; } + return s % 10 === 0; +} + +type Hit = { kind: string; line: number; text: string }; + +function scan(text: string): Hit[] { + const hits: Hit[] = []; + text.split(/\r?\n/).forEach((raw, i) => { + const line = raw.trim(); + if (!line) return; + const mask = (s: string) => (s.length > 6 ? s.slice(0, 3) + "•".repeat(Math.min(12, s.length - 3)) : "•••"); + if (/\b(pass(word)?|pwd|pw|pin|passcode|login)\b\s*[:=-]/i.test(line)) hits.push({ kind: "Password line", line: i + 1, text: mask(line) }); + else if (/^[^\s@]+@[^\s@]+\.[^\s@]+\s*[:/|]\s*\S{4,}$/.test(line)) hits.push({ kind: "Email + password", line: i + 1, text: mask(line) }); + const words = line.toLowerCase().split(/\s+/); + if ((words.length === 12 || words.length === 18 || words.length === 24 || words.length === 6) && words.every((w) => /^[a-z]{3,8}$/.test(w))) + hits.push({ kind: "Recovery phrase?", line: i + 1, text: words[0] + " " + "••• ".repeat(3).trim() }); + for (const m of line.matchAll(/\b(?:\d[ -]?){13,19}\b/g)) { + const d = m[0].replace(/\D/g, ""); + if (d.length >= 13 && d.length <= 19 && luhn(d)) hits.push({ kind: "Card number", line: i + 1, text: "•••• " + d.slice(-4) }); + } + // A line that is only a short code, like 4821-9930, in a note that mentions backup or recovery codes. + if (/^[a-z0-9]{4,5}[- ][a-z0-9]{4,5}$/i.test(line) && /\d/.test(line) && /(backup|recovery|2fa|code)/i.test(text)) + hits.push({ kind: "Backup code", line: i + 1, text: line.slice(0, 2) + "•••" }); + }); + return hits; +} + +const SAMPLE = `Wifi password: tealhouse-2291 +bank login: maria.k / Spring2019! +2FA backup codes +4821-9930 +7712-0045 +card 4111 1111 1111 1111 exp 08/29 +maple river candle orbit falcon quiet ladder pepper stone violet harbor mint`; + +export function SecretScanner() { + const [text, setText] = useState(""); + const hits = useMemo(() => scan(text), [text]); + return ( +
+

TRY IT · SECRET SCANNER

+

What's hiding in your notes?

+

Paste a note. It's checked in this page only and never sent anywhere. Results are masked.

+ +