How end-to-end encrypted note sync works

End-to-end encrypted note sync works by encrypting each note on your own device, before it touches the network, with a key that only your devices hold. The server receives a block of ciphertext, stores it, and hands it back to your other devices when they ask. It never holds the key, so it cannot read the note, and neither can anyone who steals its disks. A court order gets the same unreadable blocks, plus the account record attached to them.

The key is not stored anywhere central. It is derived on your machine from a password, using a deliberately slow key derivation function, then used to unlock the individual keys that encrypt your files. The trade is that a lost password with no backup means lost notes. Products handle that differently: some issue a recovery phrase at setup, some give you a key file to store, and some offer nothing at all, in which case a forgotten password is final.

What end-to-end encryption means for notes

Most cloud note apps encrypt your data in transit, using HTTPS, and at rest, using disk encryption on the server. Both are real protections, and neither stops the operator from reading your notes. The server holds the keys to its own disks, so a rogue employee, a leaked backup, or a court order can produce plaintext. When a pricing page says “encrypted”, this is usually what it means.

End-to-end encryption, often abbreviated E2EE, moves the key to the ends of the connection, meaning your devices. The middle becomes a courier carrying sealed envelopes it cannot open.

The steps of an encrypted sync

Here is what happens between saving a note on one device and seeing it on another.

1. Key derivation. Your password goes through a slow, memory-hard function such as Argon2id, which turns it into a master key. The slowness is the point: it makes guessing your password expensive for an attacker holding the ciphertext.
2. Per-file keys. Each note gets its own data encryption key. That key encrypts the note, and your master key encrypts that key. One compromised file key does not unlock the rest of the vault.
3. Path hiding. The file’s path goes through a keyed hash, usually HMAC, short for hash-based message authentication code, which produces an opaque identifier. The server can tell that two uploads are the same file without knowing it is called Therapy/2026-04-12.md.
4. Upload. The device sends the ciphertext, the wrapped file key, and the path identifier. Nothing readable leaves the machine.
5. Download and decrypt. Your other device fetches the block, unwraps the file key with its copy of the master key, decrypts, and writes plain markdown to local disk.

The list glosses over one thing. Signing in and unlocking your notes are separate acts with separate credentials. The sign-in proves which encrypted blocks belong to you, and in Jotura that is an email address and a one-time code. The encryption password never leaves your device, and it alone turns those blocks back into notes. Products that use a single password for both still derive the key on your machine.

Why hiding filenames matters as much as content

Filenames and folder structure are content. A vault that shows the server Legal/redundancy-consultation.md and Health/oncology-appointments.md has leaked most of the story before a single note is decrypted. Some services encrypt note bodies and leave paths readable, which is worth checking before you buy.

Keyed hashing closes that gap. The identifier is deterministic, so one path always maps to the same server-side id and sync can tell an old version from a new one. It is also one way, so the server cannot reverse it without your key.

What the server can and cannot see

Encryption hides content, not the existence of activity. The leftovers are worth knowing before you trust any service.

The server sees	The server does not see
The email address on your account	The contents of any note
The IP addresses your devices connect from	File and folder names
How many devices you have registered	Your encryption password or any key
The size of each encrypted block, and how many there are	Which note changed, by name
That it holds years of past versions of each block	Anything readable inside them

Because the path identifier is deterministic, the server holds a stable pseudonym for every note. It never learns a name, but it can watch one unnamed note for months and see when it changes and how it grows.

A subpoena to any encrypted sync provider therefore returns ciphertext wrapped in an identifying shell of email address, connection records, and shape. No product removes that entirely. Can my notes app read my notes? covers what different architectures expose.

What encrypted sync cannot do

If the provider cannot read your notes, the provider cannot reset your encryption password. There is no support ticket that recovers a vault whose key is gone. Most systems answer this with a recovery phrase generated at setup. It is commonly 12 or 24 words from the standard BIP39 wordlist, chosen so the words are hard to confuse when written by hand.

Write that phrase on paper and keep it where you keep a passport. The recovery phrase guide covers how to store one safely.

The encryption itself covers your notes in transit and on the server, and nothing beyond that. It does nothing for a laptop left unlocked, because your vault sits on local disk as plain markdown by design. Turn on full-disk encryption, meaning FileVault on Mac or BitLocker on Windows, and use a screen lock.

Signing out of sync is not a hand-off procedure either. It forgets the cached key, and your notes are still there in a folder, readable by anyone who opens it. Before you give a computer away, delete the vault and wipe the drive.

It also cannot save you from a weak password. Argon2id makes guessing slow, not impossible.

How other encrypted note apps compare

Standard Notes is open source and has published third-party security audits. You can read the client that does the encrypting instead of taking the claim on faith, which is the strongest answer anyone in this category can give. Notesnook is also open source and end-to-end encrypted, with a free tier and an iOS app.

Obsidian Sync encrypts with a password you set, and forgetting it is terminal there too. It wins on reach, with a far larger plugin ecosystem and an iOS app that Jotura does not have. Its price is broadly similar, so choose on features rather than cost. See the Obsidian comparison.

How Jotura does it

Jotura Sync uses the model above. The master key is derived with Argon2id on your device, each file gets its own key, paths become keyed-hash identifiers, and setup produces a 12-word recovery phrase. The server runs on Cloudflare Workers and stores ciphertext, never plaintext, paths, or keys. The security page has the full description.

Jotura is closed source and has had no third-party cryptography audit, so the encryption claim rests on trust in us rather than on code you can read. That is fair to hold against it. What you can check without trusting anyone is the part that matters most if we disappear: your notes are ordinary .md files on your own disk, readable by any editor.

Encryption covers the copy in transit and in the cloud, not the folder you work in. Without a cached key, sync simply pauses, so local reading, writing, and search never wait on the network.

Sync is the paid part, at £4 a month or £40 a year, with no free trial. It keeps three years of version history, with attribution on shared notes. The app itself is free on Mac, Windows, Linux, and Android. There is no iOS app.

Sharing without handing over the keys

Sharing usually breaks encryption schemes, because the obvious implementation lets the server decrypt and re-encrypt. The better approach wraps the shared folder’s key for each recipient’s own key, so the server passes along a package it still cannot open.

Jotura shares folders or single notes that way, with editor and viewer roles and automatic merging when two people edit at once. Both sides need a Sync subscription. The shared notes page covers the workflow.

Two limits belong in the same breath. Revoking someone does not re-encrypt the folder, so a removed collaborator keeps whatever they already synced. Revoking stops future access, not past copies. And shares depend on an account identity key held by your devices. If you lose every device and your vault keys at once, the recovery phrase brings back your own notes, but existing shares stay locked and you need a fresh invitation.

FAQ

Can the provider reset my encryption password? No, and that is the defining property. Your account sign-in is separate: an emailed one-time code gets you back in, and it only tells the server which encrypted blocks are yours. The password that derives your encryption key never reaches us, so nobody here can recover it.

Is end-to-end encrypted sync slower? Encryption and decryption run on your machine and are fast next to the network round trip. You are unlikely to notice them.

What if the company disappears? With a plain-file app your notes are already on your disk in a folder you control, so you lose sync, not the notes.