How does encryption work in Harbor?

Encryption in Harbor is optional — a lock you choose to use, note by note. It’s off by default, and most of your library probably shouldn’t use it.

When you encrypt a note, your device seals it before it leaves: your passphrase runs through Argon2id to derive a key, and the note is encrypted with AES-256-GCM. Our servers only ever store the sealed result. We never hold your keys — that’s what zero-knowledge means. Nobody at Cloudmanic can read an encrypted note. Not support, not us on our worst day.

The practical details:

• Per note or per notebook. Encrypt a single note, or set a notebook so its notes are encrypted — both the ones you create there and the ones you move in.
• Attachments too. Files in an encrypted note are encrypted along with it, with one exception worth knowing about.
• Easy day-to-day. Unlock with Touch ID or Face ID on Apple devices, with a stay-unlocked window and an automatic idle re-lock.
• Rotatable. Changing to a new passphrase is quick.
• Reversible — with one exception. Encrypt or decrypt any single note from the note’s own menu. The note’s version history is the exception: it doesn’t survive the trip either way.

Three honest things to know before you turn it on:

1. Encrypted content is removed from OCR, search, and API/AI access — Harbor can’t read it, so those features can’t either. See What’s the trade-off when I encrypt a note?
2. Encrypting a note deletes its version history, permanently — and so does removing encryption. The details are below, and they’re worth reading before you encrypt anything you might want an older draft of.
3. If you lose your passphrase, we cannot recover it. No back door exists — that’s the point.

Most people encrypt the truly sensitive slice — finances, health records, IDs — and leave the rest fully searchable. More at Encryption.

Changing a note’s encryption deletes its history

This is the one part of encryption you can’t take back, so it belongs near the top rather than in the small print.

Encrypting a note that already exists deletes that note’s version history. The earlier, readable versions aren’t carried over and aren’t sealed — they’re removed from our servers permanently. Removing encryption does the same in reverse, discarding the encrypted versions. Either way the note starts a fresh history from that moment, and what went is gone: not in the Trash, not recoverable by support, not recoverable by us.

Everything else survives. The note keeps its current title and body, its notebook, its tags, its attachments and its reminders — it’s only the record of what the note used to say that goes.

Why we delete rather than seal. Encryption happens on your device, so our servers can’t re-encrypt old versions themselves; every app would have to do it, and the promise would only ever be as strong as whichever app did it worst. Half-sealed history means readable old drafts sitting behind a padlock, which would make the padlock a decoration. Deleting the mismatched versions happens once, on our side, so every app behaves identically.

This includes notes you move. Dragging a note into a notebook that encrypts encrypts it, so it takes the note’s history the same way encrypting by hand does. Worth knowing before a tidy-up session.

Don’t count on being asked. The deletion is ours; the warning is each app’s own, and they haven’t all shipped one. The web app tells you before it encrypts and before it decrypts. The other apps and the harbor command-line tool may not yet — harbor notes encrypt goes ahead with no prompt at all. If a note’s earlier versions matter to you, open its history and save what you need before you change its encryption.

Moving a note into an encrypted notebook encrypts it

A notebook set to encrypt applies that to notes you move in, not just to notes you create there. Drag a readable note into it and Harbor encrypts the note as part of the move: your device seals the title, the body and the files embedded in the note, and the sealed note and its new home are saved together in one go. There’s no moment where the note is sitting in that notebook still readable — not even briefly.

This is live in the web app today. The Mac, iPhone, iPad, Windows and Android apps are getting the same behaviour — until they do, moving a note into an encrypted notebook on one of those apps leaves the note readable, and you’d need to encrypt it yourself.

Up to the moment the note is saved, anything that goes wrong leaves everything alone: the note stays readable and stays in the notebook it came from. And if Harbor asks for your passphrase and you decide against it, cancelling cancels the move too — quietly, because saying no isn’t a failure.

One step happens after the note is saved: clearing away the old, unencrypted copies of the files that were attached to it. If that step fails, Harbor tells you rather than staying quiet — the note is encrypted and moved, but those earlier copies of its files are still sitting on our servers. It’s the one outcome where part of the move lands and part doesn’t, so it’s a message worth not dismissing.

Moving several notes at once asks for your passphrase once and then works through them. If you stop part-way, the notes already done are encrypted and moved, and the rest are untouched where they were.

Moving it back out does not undo it

This is the part that surprises people, so it’s worth stating flatly: leaving an encrypted notebook never unlocks anything. Once a note is encrypted it stays encrypted wherever you put it — including back in the notebook you dragged it out of.

To make a note readable again you remove its encryption by hand, and you can only do that once the note is outside the encrypting notebook. Harbor will tell you as much if you try it in place, and offer to move the note for you. The steps are in How do I encrypt or decrypt a single note?

Worth knowing before you drag, because it’s the same trade either way: an encrypted note drops out of search, OCR and anything you’ve connected, including your AI — and, as above, the note’s version history is deleted on the way in.

Turning the setting on doesn’t encrypt what’s already inside

The reverse is also true, and it catches people the other way. Ticking “encrypt new notes by default” on a notebook that already holds notes changes nothing about those notes — they stay exactly as they are. The setting applies from then on: to notes created there, and to notes moved in. To seal the ones already sitting in it, encrypt them yourself, one at a time or a notebook at a time.