What's the trade-off when I encrypt a note?

When you encrypt a note, Harbor can no longer see its contents — and neither can any feature that depends on reading them.

Specifically, an encrypted note is excluded from:

• Search — its text won’t appear in results.
• OCR — attachments inside it aren’t indexed, so words in its scans and photos aren’t findable.
• Spotlight and Handoff on Apple devices — the system never sees it.
• The API, CLI, and MCP — which means your AI can’t see it either.

Those four are reversible: remove the note’s encryption and every one of them comes back. There’s a fifth cost that doesn’t work that way, and it’s the one to read before you act.

The irreversible one: you lose the note’s version history

Encrypting a note deletes its version history, and removing encryption deletes it too — the encrypted versions this time. Whichever direction you go, the note starts a fresh history from that moment and the earlier versions are permanently gone from our servers. Nothing in the Trash, nothing support can restore.

This catches people because it’s the opposite shape to everything else on this page. Losing search is a capability you get back the moment you decrypt. Losing the history is a thing that happened, and undoing the encryption doesn’t undo it — it just costs you another history.

The reason is the same zero-knowledge design that makes the rest of this trade real. Our servers can’t read an encrypted note, so they can’t seal its old plaintext versions either. Leaving them readable behind a padlock would make the lock a decoration, so they’re deleted instead.

Two practical consequences:

• This applies to notes you move, not just notes you lock. Dragging a note into a notebook that encrypts takes its history with it, same as encrypting it by hand.
• Don’t count on a warning. The web app tells you before both directions. The other apps and the harbor command-line tool may not — harbor notes encrypt runs with no prompt at all. If a note’s past versions matter, open its history and save what you need first.

The rest of this page is about the four costs you can take back.

Two ways a note ends up encrypted

The obvious one is that you encrypted it: you picked Encrypt this note from its menu and typed your passphrase, so the trade above was a decision you made.

The other one is quieter. Dragging a note into a notebook that’s set to encrypt encrypts it on the way in — same trade, arrived at with a gesture rather than a decision. A note you moved into your Vault leaves search, OCR and your AI just as surely as one you locked on purpose, and moving it back out doesn’t bring it back. If you didn’t mean it: move the note somewhere ordinary, then remove its encryption.

That second one is live in the web app today and is coming to the other apps — so a note you move in elsewhere is, for now, still readable rather than encrypted. Either way it’s worth knowing which is which: How does encryption work in Harbor? has the full behaviour.

So it’s worth knowing which of your notebooks are set to encrypt before you start tidying. Dragging a note into one is a decision, not just filing.

Why it works this way

This isn’t a limitation we’re working around — it’s the proof the encryption is real. Zero-knowledge means the note is sealed on your device and our servers only store what they can’t read. A search index of your “encrypted” text would mean we could read it after all. A lock that lets features peek isn’t a lock.

So the honest advice is to encrypt narrowly. Lock down the genuinely sensitive slice of your life — passport scans, financial records, medical documents, that kind of thing — and leave the rest of your library unencrypted, where OCR, search, and your tools have full power. Encrypting everything would mostly buy you a second brain that can’t remember where anything is.

And remember the other half of the bargain: your passphrase is genuinely yours alone, so losing it means losing those notes. How the sealing works is covered in How does encryption work in Harbor?, and exactly what an app or AI receives instead of an encrypted note is in Can an app or AI read my encrypted notes?