GSoC 2026 Proposal Draft - Idea 7: Local Note Encryption - keshav0479 Links Project idea: Idea #7: Local Note Encryption GitHub: github.com/keshav0479 Forum introduction: Welcome to GSoC 2026 with Joplin! Joplin PRs: PR Description Status #14776 Mobile: Fix OneDrive auth code dou…

yeah, an is_locally_encrypted flag on resources makes sense. without it there's no clean way to tell "encrypted file" from "unreadable file" in the attachment manager. i also traced a related issue in ResourceService.indexNoteResources() (L82-91) - it parses note.body to extract resource IDs via No…

[image] keshav0479: with a locally encrypted body (JOPLIN_CIPHER:...), that parse returns nothing, which would cause setAssociatedResources to mark all the note's resources as is_associated = 0, eventually orphaning and deleting them That’s a good find shared resource constraint (from discu…

on the decrypt lifecycle when unlocking- same query in reverse, when a note is unlocked, for each of its resources, check note_resources joined with notes.is_locally_encrypted to see if any other encrypted note still references it. if yes, keep the resource encrypted. if no encrypted note references…

on the decrypt lifecycle when unlocking- same query in reverse Did I misunderstand this part?: [image] keshav0479: i also traced a related issue in ResourceService.indexNoteResources() (L82-91) - it parses note.body to extract resource IDs via Note.linkedResourceIds. with a locally encrypted…

you're right, note_resources is populated by the background indexer parsing note.body, not on save. so for locally encrypted notes, relying only on indexer parsing isn't enough. fix is to call NoteResource.setAssociatedResources from the gated save path before encrypting body, while plaintext is st…

read through the solution in #87. the architecture makes sense - option-gated Resource save/load mirroring the note pattern, is_locally_encrypted on the resources table and server item, JOPLIN_CIPHER: prefix with migration fallback. one thing worth noting from the code: Resource.readyStatus (L164) …

[image] keshav0479: one thing worth noting from the code: Resource.readyStatus (L164) already returns 'encrypted' for encryption_blob_encrypted (E2EE blobs). for local encryption we'd want a distinct status like 'locally_encrypted' so the UI can distinguish between E2EE-pending-decrypt and vault…

you're right, a separate readyStatus value is probably not needed. encryption_blob_encrypted/readyStatus('encrypted') is mainly for E2EE background decrypt flow. for local encryption, the gated resource path can await decrypt when vault is unlocked, and when locked we should intentionally render th…

FYI I’m not sure how far through you got with implementing the latest changes to the proposal, but in the save section of 3.2, make sure the following sections are removed [image] keshav0479: extract resource IDs from the plaintext body via Note.linkedResourceIds(body) and call NoteResource.se…

GSoC 2026 Proposal Draft - Idea 7: Local Note Encryption - keshav0479

GSoC Projects Encrypted Notes

mrjo118 25 March 2026 02:41 39

I’ve proposed a solution here GSoC 2026 : Local Note Encryption (Draft proposal and POC) - #87 by mrjo118

Topic		Replies	Views
Secure Notes Plugins	35	1761	27 March 2026
GSoC Idea - Password-protected notes Features gsoc-2020	17	1836	21 November 2020
Vaibhav GSoC 2020 - Introduction GSoC gsoc-2020	13	710	12 March 2020
Requesting encryption of local Joplin data (at rest encryption) Features	42	8979	28 May 2021
Encrypting individual notes Features	27	8738	8 October 2025

GSoC 2026 Proposal Draft - Idea 7: Local Note Encryption - keshav0479

Related topics