Meld Encrypt: encrypted notes inside an Obsidian vault
Hide secrets in your Obsidian.md vault
At a glance
- What is it?
- Meld Encrypt is an Obsidian community plugin that encrypts a whole note or just a selected passage inside it, and never writes the decrypted text back to disk, so plaintext is not synced or backed up by whatever sync service you use. The readme is blunt about the cost of that: no password recovery, no independent audit, and bugs can appear at any time.
- Who is it for?
- Meld Encrypt is worth installing if your Obsidian vault syncs somewhere you do not fully control, and you want a second layer between your notes and that sync provider. It is the wrong choice if you need to open those notes on a machine where you cannot enter the password, if you need a recovery path, or if you need an audited encryption implementation, since the readme says the methods have not been independently audited.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 10 days ago.
- What is it written in?
- Mainly JavaScript, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 22, 2026, and from our analysis. They are not legal advice.
Editorial analysis
Two granularities: the whole note or a passage
Meld Encrypt is a community plugin for Obsidian that lets you encrypt and decrypt your notes, and it offers two choices of scope. You can encrypt an entire note, which is the simplest mental model and the easiest to reason about, or you can encrypt just selected text within a note, with the documentation splitting those two cases into separate pages, whole-encrypted-notes and in-place-encryption. The in-place case is the more interesting one, because a note in a personal vault is rarely one thing. A journal entry might have a heading, a paragraph about the day and one line with a recovery code for a service. Encrypting the whole note is simple and total, encrypting a passage is selective and leaves the rest of the file as ordinary text, which is a deliberate trade rather than a technical limitation, and one worth understanding before you decide which mode to use.
Nothing decrypted ever reaches the disk
The property the plugin leads with is that encrypted notes are never decrypted to disk, and the reason given is peace of mind that the decrypted contents have not been synced or backed up to external systems. That is a sharper guarantee than most note encryption offers, because the usual failure mode is not the file being unencrypted at rest, it is the plaintext copy that a sync client uploaded while you were editing. If the plugin only ever holds the cleartext in memory and writes ciphertext back, then a sync provider sees ciphertext, a backup sees ciphertext, and the note is only readable on a machine where you type the password. The cost of that guarantee is the same as its benefit, since the note cannot be read by any tool that does not understand the plugin, including a plain text editor, a search index or an export.
The warnings are the most useful part of the readme
The readme carries a block of warnings, and for a plugin that holds secrets they matter more than the feature list. Your passwords are never stored, so if you forget your password, your notes cannot be decrypted. The encryption methods used have not been independently audited, and unauthorized access may be possible if someone gains access to your files. Bugs may be introduced at any time, and you are solely responsible for maintaining backups of your notes. Read that last clause as the summary of the whole plugin. An unaudited implementation can be wrong in ways nobody has looked for, a software update can change behaviour without warning, and the plugin will not save you from a mistake because it holds no copy of your key. The warnings are honest, which is more than many plugins in this space manage, but they also mean the tool is best used as one layer of protection on material you have backed up, not as the only copy of anything.
What encryption does not cover, and the sync problem it does not solve
It is worth being clear about the boundary of the protection, because the vault is a folder of ordinary files and everything the plugin does not encrypt stays ordinary. If you encrypt a selected passage, the rest of the note, and the note's file name, are still plain text that any sync client, any backup tool and any search index will carry along. The plugin's guarantee is about the content you chose to encrypt. The second boundary is the sync provider itself. Because the ciphertext is a normal file in the vault, the file names, the folder structure, the modification times and the size of every note still travel to the service you sync with, and an encrypted file that grows and shrinks as you edit it leaks the rhythm of your editing. None of that is a flaw in the plugin, and none of it is fixed by encrypting note bodies. If the threat is a curious service provider rather than a lost laptop, a vault full of encrypted notes still tells them how many notes you have, what they are called and when you wrote them.
Two command line tools beside the plugin
The repository builds more than the plugin itself. Alongside the main esbuild configuration there are two separate tool configurations, one for a decrypt tool and one for a tool called mdenc, and the package scripts pair a development build with a production build for each: dev and build for the plugin, dev-tool-decrypt and build-tool-decrypt, dev-tool-mdenc and build-tool-mdenc. The production build runs a TypeScript type check that emits nothing, tsc with noEmit and skipLibCheck, and then the esbuild bundler. The tooling dependency is yargs, which is the usual choice for a command line tool. The existence of a standalone decryptor is the useful part: it means the encrypted content is not locked to the Obsidian application, so you can decrypt from a shell on a machine where you would rather not install the editor, which is a reasonable recovery path for a tool whose main warning is that you might lose access.
How the plugin is packaged and versioned
The tree is small and conventional for an Obsidian plugin. There is src for the TypeScript source, docs for the documentation site, tools for the build helpers, a manifest.json and a manifest-beta.json for the two distribution channels, versions.json recording which plugin versions map to which app versions, and a version-bump.mjs script that does the bump. The package is named meld-encrypt, its version is 2.4.5, and its main entry is main.js, the single bundled file Obsidian loads. The dependency list is a development list, since everything is bundled: esbuild for the bundling, the Obsidian API package, TypeScript 5.8, yargs, the ESLint TypeScript plugin and parser, and the type packages for Node. The linting is configured with an .eslintrc and an .eslintignore, and the documentation site is served from the meld-cp GitHub Pages site, with the release notes on their own page and bug reports and feature requests going to the issue tracker.
One maintainer, and a release line that moves slowly
The readme asks for support in three ways, starring the repository, buying the author a coffee and sponsoring on GitHub, and it says why: ongoing maintenance and development. That framing tells you the project has one person behind it. The release history matches a personal project: versions 2.4.3, 2.4.4 and 2.4.5 came out in June and July 2025, and the last push was on 2026-10-13, so the code has been touched more recently than the newest tag. That gap is the sort of thing to notice if you are putting secrets in it, because the packaged plugin a user installs is the last release, not the state of the branch. The licence is MIT, the plugin is free, and there is no paid tier. The practical summary is that this is a small, carefully worded, honestly limited piece of software from one developer, and the sensible way to use it is with backups and with the awareness that a bug in it would be your problem.
Editorial conclusion
Meld Encrypt is worth installing if your Obsidian vault syncs somewhere you do not fully control, and you want a second layer between your notes and that sync provider. It is the wrong choice if you need to open those notes on a machine where you cannot enter the password, if you need a recovery path, or if you need an audited encryption implementation, since the readme says the methods have not been independently audited. Before you encrypt anything, back up the vault, decide whether whole notes or selected text suits you, and treat the encrypted files as your only copy if you delete the originals.
Frequently asked questions
What is Meld Encrypt?
It is a community plugin for Obsidian that encrypts and decrypts notes. You can encrypt an entire note or just selected text within one, and encrypted notes are never decrypted to disk, so the cleartext is not synced or backed up by external systems.
What happens if I forget the Meld Encrypt password?
Your notes cannot be decrypted. Passwords are never stored by the plugin, so there is no recovery path, and the readme also says you are solely responsible for maintaining backups of your notes.
Has the encryption in Meld Encrypt been audited?
No. The readme states that the encryption methods used have not been independently audited, and that unauthorized access may be possible if someone gains access to your files. It also warns that bugs may be introduced at any time.
Does the Meld Encrypt plugin write decrypted text to disk?
No. The plugin's stated property is that encrypted notes are never decrypted to disk, so the decrypted contents are not synced or backed up to external systems while you work with them.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/meld-cp-obsidian-encrypt)Was this useful?