Hey everyone! It's been a while since I posted here, so before getting into the updates, let me give you a quick walkthrough of how note lock is meant to work. The feature is still in development and disabled by default, but quite a few of its pieces have now merged.
Start with a note you'd like to keep private on your laptop. You set a note lock password, choose the note, and lock it. Joplin asks for the password if the session isn't already unlocked. From then on, the note's body is saved encrypted on your device.
The title stays visible so you can still recognise the note. Attachments aren't covered yet. This works alongside Joplin's end-to-end encryption: that protects your sync data, while note lock protects the saved note body on the device.
You can keep writing after locking the note. Your password unlocks a key, the secret Joplin uses to encrypt and read its contents. Once unlocked, that key is held in memory for the session. By default, you can move between notes using the same key without typing the password again. Each save still encrypts the body, and the password itself isn't saved in settings.
When you want to hide the contents again, you can use Relock all notes. Fully quitting Joplin also ends the session. There's an option to relock when switching notes, too. Opening a locked note after that brings back the password prompt. Removing a note's lock is a separate choice that turns off encrypted storage for that note.
The editor is only one way of reaching a note, though. With note lock enabled, locked notes are left out of search. The API and command line refuse access to their bodies, including for plugins that use the API. API note listings leave locked notes out as well. Those rules stay in place while the editor session is unlocked, too.
The API and command-line protections merged during this stretch.
Now add your phone. It needs the same key your laptop uses. Sync carries an encrypted copy of that key, and your password unlocks it on the other device.
The tricky case is when both devices have already set up note lock separately before they start syncing together. They've each made a different key. Right now, the sync merge keeps only the newer one, even if some notes still need the other.
The notes can still be there, but losing their key can mean losing access for good, unless you still have that key or a readable copy of the notes. This is the main problem I'm working on now.
The proposed flow can use the key from sync directly if this device has no locked notes. If local notes still need their current key, sync pauses and both keys are kept while you decide what to do.
With both passwords, Joplin could read those notes using the old key and encrypt them again using the key from sync. Any notes that fail could be retried before finishing. Sync would resume after migration, or after an explicit choice to skip the remaining notes and accept losing access to them.
Password resets need their own handling. A normal reset should reach your other devices, while two devices resetting independently may need conflict resolution. I'm still building that handling and the desktop and mobile prompts around it.
So far, twelve pull requests have merged since coding began, including supporting fixes. The encryption and session foundations, desktop controls, password settings on both platforms and search handling have landed. The changes that preserve attachment links have merged too. I also fixed a save bug along the way: one failed validation could leave later saves of the same item hanging until restart. That fix has merged too.
The mobile lock UI, safer save path and wording cleanup are approved and awaiting merge. Note history and import/export are built but still need review and integration. Bulk locking still needs its interface, and attachment encryption remains a stretch goal.
Sharing needs another pass as well. A note can arrive already shared through sync, so preventing a local share action doesn't cover everything. The replacement approach being discussed includes recovery copies and read-only handling for locked notes that end up in shares.
Thanks especially to mrjo for the detailed reviews and for helping me work through the tricky parts of this project. Thanks to Laurent and Henry as well, and to everyone who's been following along.
I'll share another update next week and bring the project site up to date with this work too.