Private Encrypted Notes
Write something private, keep it encrypted, and share it with anyone. No complicated setup. No permanent storage.
Simple notes. Strong privacy.
Notes are encrypted in your browser before being stored. NotepadWeb stores encrypted content rather than plaintext, and the private encryption key is not stored. If you lose that key, the note cannot be recovered.
FAQ
How does NotepadWeb work?
You write the note in your browser. Before it is uploaded, the browser encrypts it. The server stores ciphertext, which is the scrambled note, plus a few details such as when it expires. There are no accounts. To open a note, someone needs the share URL and the private key. Send those two separately.
How does the encryption work?
The browser creates a private key of 256 random bits, and a separate random salt. HKDF-SHA-256 mixes the key, the salt, and a fixed label into an AES-256 key. AES-256-GCM then encrypts the note. Each save uses a new IV, a random starting value, so the same note does not produce the same ciphertext twice.
A second value, the authentication capability, is derived from the private key and hashed with SHA-256. The server stores that hash and checks it before handing the ciphertext back. The hash is not the key, and it cannot decrypt the note.
Can someone with the database read my note?
Not from the stored data alone. The database has the ciphertext, IV, and salt, but not the private key or derived AES key. The salt alone does not unlock the note. Guessing a 256-bit key is not practical.
What if I lose the private key?
The note cannot be recovered. There is no account, no password reset, and no stored copy of the key. The key is shown once after you save. Copy it or download it before you leave that screen.
What does “saved on this browser” mean?
That checkbox keeps the draft you are typing in this browser, so a refresh shows it again. The draft stays on this device only. It is not the encrypted copy on the server, and it does not include the private key. Unchecking the box deletes that local copy immediately.
Who can read, edit, or delete a note?
Anyone with the share URL and the private key can read it. They can change it only if you turned on edit access. The server enforces that. The key holder can delete the note even when editing is off. After deletion, expiry, or the view limit, the ciphertext is cleared. The note cannot be opened again.
What are the limits?
Every note expires. The longest lifetime is 365 days. You can also delete a note after a set number of successful opens. The encrypted note can be up to 1 MB.
The site serves the JavaScript that performs the encryption, so you are trusting the page you loaded. Use HTTPS. Metadata is not encrypted. While a note is open on screen, the decrypted text is in the browser. A compromised browser, or a script injected into this site, could see it then.