Zero-knowledge notes, tasks, files, passwords, journal, contacts and bookmarks, all under a single 12-word recovery phrase, with no email or password required. A BIP-39 phrase generated on your device derives every key through HKDF-SHA256, and content is sealed with XChaCha20-Poly1305 on the device as you write it, on disk as well as in transit, so the servers in Switzerland only ever hold ciphertext. The vault holds passwords, cards and SSH keys, the address book imports and exports vCard files, and the journal adds mood, sleep and medication tracking with a printable report for your doctor. A local Markdown mode edits a folder of files on your own disk without syncing them at all. The full client source for web, desktop and mobile is published on GitHub under AGPL-3.0, alongside the encryption code and the threat model, and signed apps ship for macOS, Windows, Linux, Android and iOS. It supports ‘Share & Burn After Reading’ Notes and is therefore listed in the Pastebin category, too.
PrivacyNotes
privacynotes.app/go/ptioA covered pick. Anyone can use it as a private drop-in, with no setup or know-how. Enough for most people. Threat levels
This is the zero-knowledge notes app we wanted to exist, so we built it. There’s no email and no password, which means no account to breach: a single 12-word recovery phrase unlocks everything, and every note is encrypted with XChaCha20-Poly1305 on the device the moment you write it, not on the way to a server. The whole client is open source under AGPL-3.0, so the privacy claims are yours to inspect rather than take on faith. The recovery phrase puts you in full control, you hold the only key. Pick it if you want notes, tasks, files, passwords, a journal, contacts and bookmarks in one place that genuinely no one but you can read.
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
PrivacyNotes alternatives
Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- Disclose source
- Network use is distribution
- Same license
- State changes
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.