How do I encrypt or decrypt a single note?

Encryption in Harbor is per note, and you can change your mind about any note at any time. A note keeps its notebook, its tags, its attachments and its reminders through either direction — only how it’s stored changes.

Its version history is the one exception, and it’s a permanent one: changing a note’s encryption deletes the note’s earlier versions, whichever direction you go. What that means, and how to keep what you need, below.

Encrypt a note you already have

Open the note’s actions menu — the … button in the note, or right-click it in the list — and choose Encrypt this note. (Mac and Windows use Title Case in menus: Encrypt This Note.)

Harbor asks for your passphrase if the app is locked, and walks you through setting one up if this is your first encrypted note. Then your own device seals the note before anything is sent, and Harbor confirms with Note encrypted. If the note turns out to be encrypted already — another device got there first, say — Harbor tells you that rather than encrypting it twice.

The other way a note gets encrypted is by moving it: drop a note into a notebook that’s set to encrypt and Harbor encrypts it on the way in. How does encryption work in Harbor? covers that.

Remove encryption from a note

Same menu, choose Remove encryption (Remove Encryption on Mac and Windows).

This is a genuine downgrade, so it’s worth being deliberate about. Removing encryption writes the note back in a form Harbor’s servers can read — which is exactly what puts it back into search and OCR, and what makes it visible to any app or AI you’ve connected.

The one rule: don’t strip encryption off a note while it’s still sitting in a notebook that’s set to encrypt — move it somewhere ordinary first. That’s the whole point of the notebook, and a note left decrypted inside it is a note whose notebook is lying to you. In the web app Harbor enforces it for you: it refuses, and says why.

Move to notebook… is offered right there. Elsewhere — the other apps, and the CLI — nothing stops you yet, so the order is on you: move it out, then remove the encryption.

That’s also the answer to the most common version of this question — “I dragged a note into my Vault by accident and now it’s disappeared from search.” Move it back out, then remove its encryption. Moving it out on its own doesn’t unlock anything; encryption sticks to the note, not to the notebook.

From the command line

The CLI does both directions, and it’s the quickest way to fix a batch:

export HARBOR_PASSPHRASE="…"

harbor notes encrypt 9c2e...              # seal one note
harbor notes encrypt --notebook 5b1f...   # seal every plaintext note in a notebook
harbor notes decrypt 9c2e...              # back to plaintext (asks you to type "yes")

notes decrypt asks for confirmation before it writes anything, because it’s publishing readable text back to the server; pass --yes in a script. notes encrypt asks nothing — including about the version history it deletes, so be deliberate with a --notebook sweep. Neither command writes anything unless every step before it succeeded, so a failure leaves the note exactly as it was. Keep the same order you’d follow in the apps: move the note out of an encrypting notebook first, then decrypt it.

Changing encryption deletes the note’s history

Before you do either direction, know this: Harbor deletes the note’s version history when its encryption changes.

Encrypting a note discards the earlier, readable versions. Removing encryption discards the encrypted ones. Either way they’re gone from our servers for good — not in the Trash, not recoverable by support, not recoverable by us. The note starts a fresh history from that point.

Everything else survives, which is what makes this easy to miss: the note keeps its current contents, its notebook, its tags, its attachments and its reminders. It’s only the record of what it used to say that goes.

The reason is the same one that makes encryption trustworthy. Sealing the old versions instead of deleting them would mean every app re-encrypting every snapshot on your device, and the guarantee would only ever be as strong as whichever app handled it worst — leaving readable old versions sitting behind a padlock. Deleting them happens once, on our side, so every app behaves the same way.

You may not be warned first. The deletion happens on our servers; the warning is each app’s own, and they haven’t all shipped one. The web app warns you before encrypting and before removing encryption. Elsewhere — the other apps, and the CLI — you may get no mention of it at all. harbor notes encrypt deletes the history without asking anything, and harbor notes decrypt’s confirmation is about publishing readable text, not about the history it’s also about to discard.

So if a note’s earlier versions matter to you, open its history and save what you need before you convert it. Once the conversion lands there’s nothing to go back to.

What encrypting doesn’t undo

One limit, about notes that become encrypted rather than notes that were encrypted from the start — which includes every note you move into an encrypted notebook:

• Attached files may not be re-sealed, and how much gets covered depends on where you do it. Encrypting an existing note always seals its title and body. The attached files are a different matter. harbor notes encrypt doesn’t rewrite attachment bytes at all — its --help spells that out — so the files stay downloadable and readable exactly as they were. In the apps, files embedded in the note’s body are re-encrypted, but files that arrived through an Evernote import are attached a different way and are missed, along with the small preview image our servers made of them.

That’s a known gap and we’re working on it. The safe assumption meanwhile: if something has been sitting on our servers unencrypted, treat it as having been stored unencrypted — encrypting the note afterwards doesn’t un-store it. Files you add to a note that is already encrypted are encrypted with it, as you’d expect. More detail in Can an app or AI read my encrypted notes?

Where you can do this

The per-note control is everywhere: the web app, the Mac, iPhone, iPad, Windows and Android apps, and the CLI.

Whichever you use, you’ll need your passphrase, and there’s no recovering it if you lose it. Before you encrypt anything, it’s worth reading what you give up.