Is my notes app encrypted?

Almost every notes app encrypts your notes in transit and at rest on the provider's servers — but the provider holds the keys and can read them. To check your app, ask three questions: does encryption happen on my device before upload, is the key derived from a passphrase only I know, and does it cover everything including titles, tags and folder names? If any answer is no, the provider can read your notes. A zero knowledge notes app answers yes to all three.

Are Apple Notes end-to-end encrypted?

Apple Notes is not end-to-end encrypted by default for all notes. Individual notes can be locked with a passphrase, and the optional Advanced Data Protection feature can extend end-to-end encryption to more iCloud data. However, the default synced notes are encrypted in transit and at rest on Apple's servers, where Apple holds the keys. That means a standard Apple ID recovery can expose them.

Is Google Keep encrypted?

Google Keep encrypts data in transit and at rest on Google's servers, but Google holds the keys. Google can read the content to enforce policies, comply with legal requests, and improve services. It is not a zero-knowledge or end-to-end encrypted notes app.

Is OneNote encrypted?

Microsoft OneNote encrypts data in transit and at rest on Microsoft's servers, with Microsoft holding the keys. Individual sections can be password protected, but the section and page names remain visible, and Microsoft can still access the underlying service data. It is not end-to-end encrypted by default.

Is the built-in Notes app on my phone encrypted?

Partly. Apple Notes encrypts synced notes in transit and at rest, and offers a passphrase-locked mode for individual notes, but standard notes can be recovered by Apple. Google Keep and Microsoft OneNote encrypt in transit and at rest on the provider's servers, and the provider holds the keys. None of these is zero-knowledge for all notes by default.

What is the difference between encrypted at rest and end-to-end encrypted?

Encrypted at rest means the provider's disks are encrypted, but the provider holds the key and can read your content. End-to-end encrypted means your content is encrypted on your device with a key the provider never receives, so the provider only ever stores unreadable ciphertext.

What is the safest encrypted notes app?

The safest option is one where encryption happens in your own browser or device before anything is uploaded, the key is derived from a passphrase you alone know, and everything you create is covered — metadata such as titles, tags and folder names included. Ask any vendor those three questions before trusting it.

How do I encrypt notes I already have?

Export your existing notes from your current app, then import or paste them into an end-to-end encrypted app and delete the plaintext originals. Anything left in the old service stays readable by that provider, so deleting the source copy is the step people usually skip.

What happens if I forget my passphrase in a zero-knowledge app?

In a genuinely zero-knowledge app nobody can reset it for you, because the provider has no copy of your key. That is why a recovery key generated at setup matters — it is the only supported way back into the vault.

Can an encrypted notes app still be attacked?

Yes. Encryption protects data on the server and in transit. It cannot protect you from a phishing site that captures your passphrase, malware on your own device, or someone with your unlocked screen. Auto-lock, two-factor authentication and an anti-phishing verification mark reduce those risks but do not eliminate them.

What makes a notes app truly encrypted?

Almost every notes app now advertises encryption. Very few mean the same thing by it. This page explains the difference in plain language, gives you a checklist you can apply to any secure notes app, and then shows how NotesSecured answers each point.

Three levels of “encrypted”

1. Encrypted in transit (TLS)

Your note travels over HTTPS. This is table stakes — every serious app does it. It protects the note between your device and the server, and nothing after that.

2. Encrypted at rest (provider-held keys)

The provider’s disks and database are encrypted. The provider holds the keys, so its staff, its automated systems and anyone with a lawful order can read your notes. Most mainstream notes apps stop here.

3. End-to-end / zero-knowledge

Your note is encrypted on your device with a key derived from a passphrase the provider never receives. The server only ever stores ciphertext. Nobody at the company can read your notes, even if they want to. This is the only level that survives a server breach.

The quickest test: if the provider can restore your notes after you reset your password, they can read your notes.

Are Apple Notes, Google Keep and OneNote encrypted?

This is the most common question people ask when they first look for an encrypted notes app. The short answer is: all three encrypt data in transit and at rest, but the provider holds the key. That means the company can restore your notes after a password reset, can read them under a lawful order, and can lose them in a breach of the provider’s own key management. Only a zero-knowledge app removes the provider from the trust chain.

Apple Notes

Individual notes can be locked with a passphrase, and Advanced Data Protection can extend end-to-end encryption to more synced data. By default, however, synced notes are encrypted at rest by Apple-held keys, and Apple account recovery can expose them.

Google Keep

Google encrypts notes in transit and at rest on its servers, but Google holds the keys. It is not marketed as end-to-end encrypted and should not be treated as a private notes app for sensitive material.

Microsoft OneNote

OneNote stores data encrypted at rest on Microsoft servers with Microsoft-held keys. Password protection can be applied to individual sections, but section names and many service fields remain readable by Microsoft.

A checklist for any encrypted notes app

Where does encryption happen?
On your device or in your browser, before the network request — not on the server after upload.
Who holds the key?
Only you. The key is derived from your passphrase and is never sent to the provider.
What is encrypted?
Not just note bodies: everything you create, including titles, tags, folder names, to-do lists and attachments. Unencrypted titles leak more than people expect.
What happens on password reset?
If the provider can restore your notes after a password reset, they can read them. A zero-knowledge app needs a separate recovery key.
Is the plaintext ever cached?
Decrypted text should live in memory only, and be discarded on lock, tab close or sign-out.
What happens on export?
An export is a new copy. Look for exports that stay encrypted, or a clear warning when they do not.

How NotesSecured answers the checklist

Encryption happens in your browser with AES-256-GCM before any network request.
The key is derived from your passphrase with PBKDF2; only the wrapped master key, a salt and a verification check are stored.
Everything you create is encrypted — note bodies, to-do lists, titles, tags, folder names and attachments — not just the body text.
A password reset does not recover your vault. A recovery key you generate yourself is the only supported way back in.
Decrypted text lives in memory only; the master key is wrapped under a non-extractable session key and erased on lock, tab close or sign-out.
Exports can be produced as an encrypted vault file that opens only with your passphrase.

What encryption cannot do. No encryption protects you from a phishing site that captures your passphrase, from malware on your own device, or from someone using your already-unlocked screen. Auto-lock, two-factor authentication and the anti-phishing verification mark reduce those risks — they do not remove them.

Frequently asked questions

Is my notes app encrypted?: Almost every notes app encrypts your notes in transit and at rest on the provider's servers — but the provider holds the keys and can read them. To check your app, ask three questions: does encryption happen on my device before upload, is the key derived from a passphrase only I know, and does it cover everything including titles, tags and folder names? If any answer is no, the provider can read your notes. A zero knowledge notes app answers yes to all three.
Are Apple Notes end-to-end encrypted?: Apple Notes is not end-to-end encrypted by default for all notes. Individual notes can be locked with a passphrase, and the optional Advanced Data Protection feature can extend end-to-end encryption to more iCloud data. However, the default synced notes are encrypted in transit and at rest on Apple's servers, where Apple holds the keys. That means a standard Apple ID recovery can expose them.
Is Google Keep encrypted?: Google Keep encrypts data in transit and at rest on Google's servers, but Google holds the keys. Google can read the content to enforce policies, comply with legal requests, and improve services. It is not a zero-knowledge or end-to-end encrypted notes app.
Is OneNote encrypted?: Microsoft OneNote encrypts data in transit and at rest on Microsoft's servers, with Microsoft holding the keys. Individual sections can be password protected, but the section and page names remain visible, and Microsoft can still access the underlying service data. It is not end-to-end encrypted by default.
Is the built-in Notes app on my phone encrypted?: Partly. Apple Notes encrypts synced notes in transit and at rest, and offers a passphrase-locked mode for individual notes, but standard notes can be recovered by Apple. Google Keep and Microsoft OneNote encrypt in transit and at rest on the provider's servers, and the provider holds the keys. None of these is zero-knowledge for all notes by default.
What is the difference between encrypted at rest and end-to-end encrypted?: Encrypted at rest means the provider's disks are encrypted, but the provider holds the key and can read your content. End-to-end encrypted means your content is encrypted on your device with a key the provider never receives, so the provider only ever stores unreadable ciphertext.
What is the safest encrypted notes app?: The safest option is one where encryption happens in your own browser or device before anything is uploaded, the key is derived from a passphrase you alone know, and everything you create is covered — metadata such as titles, tags and folder names included. Ask any vendor those three questions before trusting it.
How do I encrypt notes I already have?: Export your existing notes from your current app, then import or paste them into an end-to-end encrypted app and delete the plaintext originals. Anything left in the old service stays readable by that provider, so deleting the source copy is the step people usually skip.
What happens if I forget my passphrase in a zero-knowledge app?: In a genuinely zero-knowledge app nobody can reset it for you, because the provider has no copy of your key. That is why a recovery key generated at setup matters — it is the only supported way back into the vault.
Can an encrypted notes app still be attacked?: Yes. Encryption protects data on the server and in transit. It cannot protect you from a phishing site that captures your passphrase, malware on your own device, or someone with your unlocked screen. Auto-lock, two-factor authentication and an anti-phishing verification mark reduce those risks but do not eliminate them.

Keep reading

Compare encrypted notes apps Security & data residency Documentation

Try NotesSecured