Skip to content

Note Encryption

Encryption is configured per repository. To enable it, go to Repositories > Long press on a repository > Encryption

Encryption Methods

1. End-to-End Encryption

  • All newly created notes in this repository will be encrypted.
  • Your password is securely stored in the Android Keystore.
  • The salt and other decryption details are embedded within each encrypted note file.
  • You can share encrypted notes with others (e.g., via email); the recipient only needs the password to decrypt them.

2. Password-Based Encryption

  • Notes are encrypted using a user-defined password.
  • If you uninstall Zettel Notes (which clears the SALT) or forget the password, the notes cannot be decrypted.
  • Decryption is possible between Android devices if the same salt is used.
  • To do this, copy the salt from Settings > Encryption Salt
  • If two devices have the same salt and the user knows the password, encrypted notes can be shared and decrypted across devices.
  • Only an asymmetric password hash (using Argon2) is stored locally. This hash is used to verify the password during decryption.
  • The user password is never stored in Zettel Notes.
  • If the password is reasonably strong, it is not possible to recover it from the stored hash.

3. OpenPGP Encryption

  • Notes are encrypted using a PGP key provided by an external OpenPGP application.
  • This is enabled through integration with OpenKeychain: Easy PGP.

4. PGP Key Encryption

  • An in-app PGP key is used for encryption.
  • You can generate the key via Settings > Keys Manager
  • Note encryption and decryption are seamless, similar to End-to-End Encryption.

Encrypted repositories (gocryptfs)

Besides per-note encryption, a whole repository can be stored in a gocryptfs encrypted folder v3.1.4. gocryptfs encrypts each file, and its file name, separately, so an encrypted repository works with file-based sync tools.

You can set one up from the redesigned repository creation screen in two ways:

Option Use it when
Create a new encrypted repository You are starting a new vault for your notes.
Use an existing encrypted repository You already have a gocryptfs folder, for example one created on a computer or with another Android app.

Warning

If you forget the password of a gocryptfs repository, its notes cannot be decrypted.

Encrypted notes are decrypted only when you open them. By default, their content is still indexed so that search can find them. To keep encrypted content out of the search index, change the option in Settings > Security.

Note history of encrypted notes is encrypted as well.