RunLocalTools

Encrypted Notes Vault: Free Passphrase-Locked Notes, Secrets and Files in Your Browser

Free encrypted notes vault that runs in your browser. AES-256-GCM, PBKDF2 or Argon2id, secrets, attachments and .rltvault backups. Nothing is uploaded.

What it does

Encrypted Notes Vault keeps notes, logins and small files behind a passphrase, inside your own browser. You create a named vault, choose a passphrase, and write plain notes or “secret” entries with hidden fields such as passwords and recovery codes. You can attach files, search everything, keep ten earlier versions of each note, and export an encrypted backup you can restore on another device.

Nothing is uploaded and there is no account. What the browser stores is ciphertext.

How it works

  • Key derivation. Your passphrase is normalised (Unicode NFKC) and stretched with PBKDF2-SHA-256 at 600,000 iterations by default, adjustable up to 2,000,000. You can choose Argon2id instead (64 MiB or 128 MiB of memory) if you prefer a memory-hard function.
  • Encryption. The vault is encrypted with AES-256-GCM using the browser’s built-in Web Crypto API, with a fresh random IV on every save. A separate key is derived from the passphrase with HKDF, so the record key and the file key are not the same value.
  • What is inside the encrypted blob. Note titles, bodies, tags, dates, secret fields, history and attachment file names. Only the vault name, its dates, its size and the key-derivation settings stay readable, because the lock screen needs them.
  • Files. Each attachment is encrypted separately with its own random IV, so you can download one file without decrypting the rest. Changing your passphrase does not require re-encrypting your files.
  • Wrong passphrase. AES-GCM authenticates the data, so a wrong passphrase (or a tampered file) fails cleanly instead of producing garbage. After three wrong attempts the unlock form adds a growing delay.
  • Locking. The CryptoKeys are non-extractable and are dropped when you lock. The vault locks on the Lock button, on Ctrl/Cmd+L, after an idle time you choose (1, 5, 15 or 30 minutes), when you leave the tool, and optionally when the tab is hidden. Copied secrets are cleared from the clipboard after 30 seconds, as far as the browser allows.

How to use it

  1. Open the tool and choose Create a new vault. Give it a name and a long passphrase. A passphrase of four or five unrelated words works well, and the password generator can produce one.
  2. Tick the two boxes confirming that there is no recovery and that clearing site data deletes the vault, then create it.
  3. Add notes or secret entries. Everything saves automatically as you type, and it is still there after a refresh.
  4. Use the search box, tag filter and sort menu to find things. Deleted notes go to Trash and can be restored.
  5. Press Backup and keep the .rltvault file somewhere safe, such as a USB drive or another cloud folder of your choice. It is encrypted, so it is safe to store anywhere.
  6. Lock the vault when you are done. To restore on another device, drop the .rltvault file onto the restore area and unlock it with the same passphrase.

Notes can be written as Markdown and previewed; if you want a fuller editor for long documents, the Markdown editor is built for that. For quick throwaway notes that do not need encryption, Simple Text Editor / Notes is lighter. To encrypt a single message to send to someone else rather than store it, use Encrypt / Decrypt Text.

Import and export

  • Encrypted backup: .rltvault, including all attachments. Restore as a new vault or replace an existing one.
  • Plain exports (after an “unencrypted” warning): Markdown files in a .zip, JSON, and CSV of your secret entries. The CSV guards against spreadsheet formula injection.
  • Import: text and Markdown files become notes.

FAQ

Can you recover my vault if I forget the passphrase?

No. The passphrase is never stored or sent anywhere, so there is nothing to reset. If you lose it and have no memory of it, the data cannot be opened by anyone. That is the price of nobody else being able to read it.

What happens if I clear my browser data?

The vault is deleted with it, because it is stored in your browser. This is why the tool asks you to keep a .rltvault backup. The tool also asks the browser for “persistent storage” so it will not be evicted automatically, and shows how much space you are using, but only a backup protects you from clearing site data by hand.

Is this as secure as a dedicated password manager?

It uses standard, well-reviewed primitives, but it is a web page, so it cannot do everything a desktop app can. JavaScript cannot guarantee that memory is wiped after locking, and nothing in a browser can protect you if your device or browser is already compromised (malware, a malicious extension, someone using your unlocked session). It has no biometric or hardware-key unlock. Use a long passphrase on a device you trust.

Should I pick PBKDF2 or Argon2id?

PBKDF2 is the default because it is built into every browser and works fully offline. Argon2id is harder to attack with GPUs because it needs a lot of memory, but it relies on a small WebAssembly library that is downloaded when the browser cache is empty. If that library can never be loaded, an Argon2id vault cannot be unlocked until it can, so keep a backup and consider your setup before choosing it.

Can I check whether my passphrase has been in a data breach?

Yes, as an optional step that is off by default. See the Privacy section below for exactly what it sends.

Does the idle timer protect me if someone copies my browser storage?

No. The timer protects an unlocked session on a shared screen. If someone copies the stored ciphertext, the only protection is your passphrase and the key-derivation cost, so a longer passphrase and more iterations matter more than any delay.

Privacy

Local (the whole tool): Creating, unlocking, writing, searching, attaching files, version history, exports, backups, restores and the password generator all happen in your browser. Your passphrase, plaintext notes and keys are never uploaded, never written to storage and never put in the page URL. Only ciphertext is stored (in your browser’s IndexedDB), plus the vault’s name, dates, size and key-derivation settings. A few preferences (auto-lock time, sort order, last vault) are saved locally and never contain secrets.

Uses the internet only if you opt in: the breached-passphrase check is switched off by default and cannot run unless you tick its checkbox. When you do, the tool computes a SHA-1 hash of your passphrase in your browser and sends only the first five characters of that hash to haveibeenpwned.com (the k-anonymity method). The full hash and the passphrase never leave your browser. The tick is never remembered; it resets every time.

Libraries that download once (no data sent): a password-strength estimator, Markdown preview libraries, and (only if you pick Argon2id) a WebAssembly hashing library are loaded from a public CDN at fixed versions the first time they are needed. Your notes and passphrase are not part of those requests.

Limitations

  • No recovery of a forgotten passphrase.
  • Clearing site data, using a private window, or a browser that blocks storage can delete or prevent saving; keep a .rltvault backup.
  • Attachments over 25 MB trigger a size warning, and files over 100 MB are skipped.
  • Cannot defend against a compromised device or browser, and cannot guarantee memory wiping.
  • No WebAuthn, passkey or biometric unlock.
  • Two tabs editing the same vault: the second tab to save writes a “(conflict copy)” vault instead of overwriting the first.