Notesnook: An E2E Encrypted Note-Taking App That Opens Its Entire Stack

What Notesnook Solves and Who It Is For

Notesnook targets people who want an Evernote-like note-taking experience without surrendering access to their data. The README states it is a free and open-source note-taking app focused on user privacy and ease of use. The core promise is zero knowledge: everything is encrypted on the device using XChaCha20-Poly1305 and Argon2. This is for users who are willing to trust a smaller project over established commercial alternatives, and for developers who want to study or extend a full note-taking stack. The project covers web, desktop, and mobile clients, so the intended audience spans individual users and tinkerers who want a self-contained, auditable solution.

The Encryption Mechanism: XChaCha20-Poly1305 and Argon2

The README names the two cryptographic primitives: XChaCha20-Poly1305 for authenticated encryption and Argon2 for key derivation. The actual implementation lives in the @notesnook/crypto package, which is described as a cryptography library wrapper around libsodium. There is also @notesnook/sodium, a wrapper that makes libsodium work in both Node.js and the browser. This split matters: the crypto core is isolated from the UI and can be audited independently. The README also points to Vericrypt, a separate tool that lets users verify the encryption claims themselves. That is a concrete step toward transparency, though the repository itself does not include the verification code, so you would have to visit that external site to test the claims.

Monorepo Architecture: Every Client, One Codebase

The repository is a monorepo with a clear table of contents. The apps folder holds the web client, the desktop client (Electron), the mobile clients (React Native), and a web clipper extension. The packages folder contains the shared core, crypto, editor, logger, theme, and a streaming file system. The core package is the shared logic across all platforms, which means the business logic is not duplicated per client. The editor is its own package, and there is a thin wrapper for mobile. This structure is sensible for a project that must keep feature parity across web, desktop, and mobile. The downside is that building any single client likely requires understanding the whole monorepo, which raises the barrier for contributors who only care about one platform.

Getting It Running: Build and Development Commands

The README does not list explicit build commands, but it does say that NPM is the package manager and that the project does not use Yarn or PNPM. It also says each project in the monorepo has its own architecture details. So a developer would start by cloning the repository, running npm install at the root, and then looking into the specific app folder, such as apps/web or apps/desktop, for its own README or scripts. The absence of a top-level build guide is a small friction point. The README directs contributors to the contributing guidelines file for style and PR rules, but it does not give a quick start. That means the first build attempt will involve reading per-package documentation, which is a real cost for new contributors.

Limitations and Failure Modes

A genuine limitation is the hybrid state of the codebase. The README admits that the repository is in a hybrid state, with newer code in TypeScript and older code being slowly ported. That means a contributor might encounter inconsistent patterns and a higher risk of type-related bugs. Another limitation is the reliance on a single email-based account system. The README links to a blog post explaining why an email address is required, but for users who want complete anonymity, that is a barrier. The project also does not appear to offer self-hosting; the clients sync through Notesnook's servers, which are not described in the repository. If the service shuts down, the clients may become useless unless the sync protocol is documented elsewhere. The README does not include that documentation.

Real Alternative: Joplin and Its Approach

Joplin is a direct alternative. It is also open source and supports end-to-end encryption, but it takes a different approach. Joplin lets users sync with their own Nextcloud, WebDAV, or filesystem, whereas Notesnook appears to use its own sync service. Joplin's encryption uses AES-256 and a master password, while Notesnook uses XChaCha20-Poly1305 with Argon2. The architectural difference is significant: Joplin is a single desktop/mobile app with a plugin system, while Notesnook is a monorepo with separate clients and a shared core. For a user who wants to control their sync destination, Joplin is the better fit. For a developer who wants to audit the entire stack, Notesnook's monorepo offers more surface area to inspect.

Maintenance and License Implications

The repository is actively maintained, with recent releases for Android and Desktop in August 2026. The license is GPL-3.0, which has real implications. If you embed Notesnook's code into your own project, that project must also be GPL-3.0. This is fine for personal use or for a new open source project, but it is a blocker for proprietary applications. The README mentions that the decision to go fully open source is a step toward transparency, but it does not discuss dual licensing. The codebase is large, and the maintenance cost is non-trivial: you have to keep up with updates across web, desktop, and mobile, plus the crypto and editor packages. For a single developer, that is a heavy burden. The presence of a streamable-fs package suggests they have invested in handling large files, but that also adds complexity to the storage layer.

Editorial conclusion

Adopt Notesnook if you want a cross-platform note-taking app with client-side encryption and the ability to inspect or modify every layer, from the crypto wrapper to the editor. Do not adopt it if you need a stable, plugin-rich ecosystem or if you are unwilling to manage a monorepo with multiple build targets and a GPL-3.0 license. Before committing, verify that the current release supports your platform, review the import/export tools for your existing notes, and check the repository's issue tracker for any unresolved sync or encryption bugs.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes