Encrypt a document
- Open the document and choose File → Encrypt / Lock (Alt+Shift+S).
- Enter a password, and enter it again to confirm.
- Choose where to save the encrypted document (
.md-crypted). - Then choose where to save the key file (
.key).
Encryption uses AES-256-GCM, and the key is derived from the password with Argon2id. From then on, saving writes the encrypted form. Encrypted text is stored as UTF-8 with LF line endings.
The key file alone is enough to decrypt the document. Keep it somewhere other than the encrypted document, and not in the same cloud folder. If you lose both the password and the key file, the document cannot be recovered.
What is encrypted is the text. The file name, its size and its timestamps are not protected. Attachments such as images are separate files, so do not treat them as protected by encrypting the text.
Open and lock
When you open an encrypted document, enter the password or drop the key file onto the decryption dialog. Once it is unlocked, you edit it like any other document.
When you step away, Alt+Shift+S locks it manually. Settings → Security sets automatic locking after a period without input.
Locking does not write unsaved text to the file. Unsaved changes come back unsaved once you unlock. Saving is unavailable while locked, so unlock first.
After ten failed decryption attempts in a row, further attempts are held off for 60 seconds. Wait for the time shown and try again.
Turn a document back into plain Markdown
Right-click a decrypted tab, choose Decrypt to Plaintext and pick where to save it. A normal .md file is created, and the encrypted file stays where it is.
Exporting to HTML or PDF and printing are not ways to distribute the text in encrypted form. Check where the output goes and how it is handled.
Stop automatic requests to the internet
Set Settings → Network → External Resource Fetching to Do not fetch (link text only).
By default, external images, YouTube thumbnails and the information behind link cards are fetched. If you would rather not let a site learn that you opened a document, change this before you open it. The same policy applies to exports.
Links to executable files are not launched. The confirmation before opening other local files in another app is adjustable under Settings → System → Confirm before opening in an external app.
What reaches AI and external tools
Even though your documents live locally, calling AI or an external tool sends whatever you configured it to send. AI in particular attaches the current document automatically. See what AI sends and the input settings of external tools.
Stored tokens are encrypted using a key tied to the computer and user account. This does not protect them from someone who can read files as the same OS user; that protection depends on the operating system’s file permissions.