GSOC 2026 Proposal Draft - Idea 7: Supporting Encryption of Notes and Notebooks - Sivaprakash P

GSoC GSoC Proposal Drafts
1

GSOC 2026 Proposal Draft - Idea 7: Supporting Encryption of Notes and Notebooks - Sivaprakash P

Links

Introduction

I am Sivaprakash, a second-year student at Thiagarajar College of Engineering, India (UTC+05:30). I have programming experience in languages such as JavaScript, Rust, Python and C. I have created simple tools for users in Rust. I have an interest in learning and implementing lower-level concepts of Computer Science. I have always wanted to contribute to open-source and have open-sourced my projects in order to learn the practices and methods. I have created React Projects like Quizcraft and Homepage of JUSST. The codebase of Joplin is new to me. But I look forward to contributing to the codebase of Joplin in the interim and getting to understand the codebase more.

Project Summary

Problem that is solved

Notes containing sensitive information are open in the memory of the user system through the SQLite Database. The notes are not encrypted and can be intercepted by any person who can read the database. By encrypting the notes and notebooks with a password or a passkey, the notes and notebooks containing sensitive information are secured by a layer of encryption hence saving them from attackers and unauthorized people. A system to export and import the encrypted notes is also implemented.

How Users are benefited

  • Users can now save sensitive information behind the protection offered by encryption based on the password with which they have saved their notes.
  • Users can export and import the locked notes with a safe and secure system.

What will be implemented?

A encryption system that will encrypt the content and attributes of the note such as dates, timestamps and location with key-based encryption. Being able to export and import encrypted notes and notebooks.

Expected Outcome

A feature in Joplin that helps users to lock their notes behind a secure layer of encryption which can only be decrypted when the password is presented. The ability to export and import the encrypted notes and notebooks.

What will not be implemented?

  • Transmission of encrypted note over network or sharing an encrypted note with others.
  • Recovery of data in case the password is lost.

Technical Approach

Components Involved

  1. Encryption System

    • Takes a password and the contents of the note with its attributes
    • Hashes the password string with a salt known only to Joplin
    • Uses the generated hash as the key to encrypt the note and its attributes with an encryption algorithm like AES or XChaCha20-Poly1305.
    • The original attributes of the note are stored in the database as such.
    • The hash is not stored but the encrypted data will be stored within the database just like other notes with a encrypted flag set to true (For other unencrypted notes, this column will be false)
    • On recovery of data, the user will be prompted for password.
    • The password will be used to decrypt the attrubutes of the note like created date, modified date, etc. and the decrypted date will be checked with the original data stored to check the authenticity of the password.
    • Once the password is confirmed to be authentic, the data of the note is decrypted and presented to the user.
    • On further edits to the data of the note, the encryption will happen again only if changes have been made to the data of the note.
    • Encrypting the Notebook will just be a iterative call of encrypting each note in the notebook by changing the contents in the SQLite Database.
    • On encrypting a Notebook, the notebook will be locked and can only be opened with a password.
    • The salt for encryption can be created on each system locally. This would ensure that the encryption is local and unique for everyone, making it more secure.

  2. Frontend (UI):

    • The UI that provides the options to encrypt a note or notebook
    • Password prompt to get the password from the user.
    • If needed, a way to show hidden information before decrypting it with password

  3. Exporting the encrypted notes:

    • While exporting the notes, the encrypted notes cannot be exported as such.
    • Either they should be exported with the salt that was generated on the system or they should be encrypted in a different way so that the user can access them in another system.
    • The optimal approach would be to create a seperate salt for the export and exporting the salt with the exported notes. The notes, on export, will be decrypted (with user password) and then encrypted with the same password but with the new salt.
    • On import, the user password will be asked for individual notes and notebooks (as the mentioned approach lets users have seperate passwords for each locked note and notebook) so that the notes can be decrypted with the imported salt just to be encrypted again with the salt stored in this Joplin locally.

Changes to Joplin Codebase

  1. Addition of columns
    • A isencrypted column to show which notes are encrypted and which are not. (Initially all rows will be set to false. User can toggle the value for required notes)
    • Columns to store the encrypted attributes of the note to find if the password is correct or not.
    • Columns to store whether the notebook is encrypted or not. If so, columns to store encrypted attributes.
  2. Encryption system
    • A module inside which all the functions and code for the encryption system with all its tests will live.

Technologies planned to use

  • Implementation of AES or XChaCha20-Poly1305 algorithm for encryption (chosen based on further talks with mentor) in TypeScript.
  • React with TailwindCSS for frontend. Maybe a Component library like Daisy UI or ShadCN.
  • SQLite for Database (The same used by Joplin).

Potential Challenges

  • When user forgets the password, encrypted notes are lost forever.

Testing Strategies

  • Reading the encrypted data from the database and trying to decrypt the data of the note
  • Brute forcing the password and checking if the system breaks.
  • Checking the consistency of the encryption system over multiple similar passwords.

Documentation Plan

  • Each module will have documentation inside the source code itself
  • A README.md file inside each module
  • A separate report on the changes that I have done.

Implementation Plan

Week 1

Create changes to the schemas of the SQLite Database by adding required columns without breaking the existing notes, records and table structure. Fixing conflicts in the database structure with the existing codebase, if any.

Week 2 and 3

Adding the option to encrypt the notes and notebooks in UI of Joplin. Creating the encryption system.

Week 4

Testing the encryption system and its functions. Making sure that salts and other sensitive data are not accessible.

Week 5 and 6

Implementing the decryption system and testing its functionalities. Making sure that the sensitive information stay encrypted unless the correct password is provided.

Week 7 and 8

Creating the export and import systems for encrypted systems.

Week 9

Embedding the created systems into the existing systems of Joplin and testing for any breaks.

Week 10

Writing Test Suites and Documentation.

Week 11

Fixing bugs. Making the system consistent with other functions of Joplin. Writing the report.

Week 12

Completing any backlogs and getting verification from the mentors.

Future Enhancements

  • Creating encryption with Zero Trust Authorization tools like Yubikey.

Deliverables

  • A tested, well-documented encryption system that can encrypt and decrypt notes and notebooks.
  • UI to implement the encryption system inside Joplin.
  • The ability to import or export encrypted notes and notebooks.

Availability

  • Time zone: IST (UTC+05:30)
  • Will be available for about or more than 20 hours a week.

Other Commitments

  • I have my Internals and University exams from the first week of May to the first week of June.
  • I have to attend an internship during my summer holidays which will take 4 weeks. (I can contribute to the project during this time. A mention here as it is a major commitment during the coding time).

Looking forward to contributing to Joplin.

Thank You!