After using Joplin with encryption for a long time, I was somewhat shocked to discover that image attachments are not encrypted at rest on the local device. If you go into the folder .config/joplin-desktop/resources, there are a lot of .png attachements that are unencrypted. Though it is probably t…

This is currently unsupported. See: Images and attachments are not encrypted · Issue #5084 · laurent22/joplin · GitHub Requesting encryption of local Joplin data (at rest encryption) Attachment locally unencrypted Is the local database unencrypted? Does Joplin encrypt md files at rest (both locall…

There is an FAQ entry . It isn't only images, your data is stored in the sqlite database which can be opened. It does state that Joplin supports end-to-end encryption, not at rest encryption.

Thanks. I did look at the FAQ before posting, but I didn't read that entry because the title is a bit misleading. Instead of saying "Could there be a password to restrict access to Joplin?", I would probably say instead "Are my data encrypted?" (or, "Are my data encrypted at rest?" Or "Are my data e…

Many applications don't encrypt their data at rest, yet there's no strong warning about it anywhere. Thunderbird for example deals with a lot sensitive data but they don't show any warning, why would they? Also we document what E2EE is, and nowhere do we claim that it means data is encrypted at res…

Thunderbird doesn't have an "end-to-end encryption" option like Joplin does. I agree that you document what E2EE is. However, I am the kind of person that likes to read manuals and documentation. If I was confused about this, I am certain that other people are as well. Would there be a willingness…

Hmm, I'm not against clearing confusion but we generally don't document what the app doesn't do, simply for practical reasons. It's hard enough to document what the app does and maintain and translate this, never mind doing the same for what it doesn't do. WhatsApp or Signal for example are well kn…

You are right that E2EE and encryption at rest are two different things. But what percentage of people know this? And of those that do, what percentage will just assume that you are using a method similar to a password manager?

Would a strong warning prevent questions about encryption at rest? The password FAQ entry and related discussions don't seem to prevent questions. If users won't research before posting, docs are futile. If they would research prior and someone is willing to maintain docs, practical reasons to docu…

[image] muzak: If they would research prior and someone is willing to maintain docs, practical reasons to document what the app doesn't encrypt include: It seems that Google already gives good results for this? [image]

If you change you mind, and would like someone to help in improving the documentation, just contact me. I understand the time commitment that this task involves.

Images are not encrypted at rest on local device

Development

laurent 5 July 2024 17:49 10

It seems that Google already gives good results for this?

Biometrics: automatically relock after a while in background

Topic		Replies	Views
Requesting encryption of local Joplin data (at rest encryption) Features	42	8983	28 May 2021
[RESOLVED] Joplin leaks private info despite end-to-end-encryption enabled Features	47	2965	26 April 2022
Does Joplin encrypt md files at rest (both locally and remotely), or only in transit? Support	17	2471	28 May 2024
Encrypting individual notes Features	27	8738	8 October 2025
Encrypt or not encrypt? Lounge	19	3641	3 July 2025

Images are not encrypted at rest on local device

Related topics