NoteVault Can Actually Lock Your Notes — Real Encryption, Not Just a Password Screen

An app that just shows a password screen before you can see your files isn't actually protecting them — anyone with access to your computer's file system could open the raw file directly and read it, login screen or not. NoteVault's vault lock doesn't work that way: setting a master password derives a real encryption key, and the notes you choose to protect are encrypted on disk with it, not just hidden behind a UI gate.

What actually happens when you set a master password

Your password is run through scrypt, a deliberately slow key-derivation function designed to resist brute-forcing, to produce a 256-bit key — the password itself is never stored anywhere. That key encrypts individual notes with AES-256-GCM, the same authenticated-encryption standard used across modern security-conscious software, producing a locked file that's unreadable without the key. Choosing to stay unlocked between sessions stores that derived key using your operating system's own credential store, not a plaintext file NoteVault invented itself.

None of this is on by default

Encryption currently applies to individual markdown notes you explicitly choose to encrypt — it's not a whole-vault-at-rest scheme covering every file type. And the app-level lock screen only exists once you've set a master password in the first place: skip that setup, which is the default state for a new vault, and NoteVault opens straight in with no password screen and nothing encrypted, exactly as if the feature didn't exist. Setting a master password is what turns both of those on at once — the lock screen for the app itself, and the option to encrypt an individual note.

For a vault that's already local-only and never synced anywhere, that opt-in step is the missing piece if you want it: the difference between "nobody stumbling onto my laptop can casually browse my notes" and "even someone who copies the file off my disk can't read it without my password" — but it's a step you have to take, not something NoteVault does for you out of the box.