Some notes are nobody's business. MojoPad encrypts at two levels, both with AES-256-GCM and scrypt key derivation — modern, audited primitives.
A password is always typed into a window of MojoPad's own — a small panel in front of your wiki, never a box inside the page you were reading. That is deliberate, and it is the one thing about encryption you can actually see, so it is worth a paragraph.
A page in a wiki can carry a script, and you can choose to let it run. Code you have allowed runs inside the window you are reading in — which used to mean it shared a room with the box you typed your password into. Refusing to let code press buttons does not help here: reading a box is not pressing anything. And a password you typed once was kept in that same room for the rest of the session, so your edits could be sealed again each time you saved.
Both of those have moved out. The panel that asks is its own window, which a document's code cannot see into; and what you type goes straight to the part of MojoPad that does the encrypting, so the window you are reading in never holds your password at all — not while you type it, and not afterwards. A wrong password is refused in the panel, beside the box, so you can try again without losing your place.
What you will notice: a locked page shows an Unlock button rather than a box, and Encrypt Page and Set Document Password ask in the panel. Unlocking a page you already opened earlier in the same session does not ask again. Everything else is as it was.
Edit ▸ Encrypt Page… (⇧⌘E). Choose a password (and an optional hint).
From then on the page's content exists on disk only as ciphertext. Locked pages show a
lock screen in the editor and a 🔒 in the page list, and they are excluded from
search, linking, exports, AI indexing, the web server, and Static Publishing —
no leaks through side doors. Unlock with the password; the page stays unlocked until
the document closes (or the re-lock timer fires).
What MojoPad keeps from the page on its own goes at the same moment, except your backups, which go as newer ones replace them, whether you give it the password here, in another window or on your other Mac: its task lines leave Reminders, the share on your network stops serving it, a DOI or other identifier in its properties no longer finds it from a citation, the Journal drops any tension or idea drawn from it, and the outline and task groups you folded on it leave this Mac’s own storage, with a board’s Undo history and the flashcards drawn from it. A research run you gave it to stops, the copy of it the run kept on this Mac is deleted at once, and what the run found is deleted rather than made into a page. The browser extension stops highlighting its name within a few minutes. Every index search by meaning keeps in the wiki lets go of it, and so do your saved searches. On this Mac all of this happens as soon as the password reaches it while the wiki is open here; a password given on your other Mac while the wiki is closed here takes effect the moment MojoPad next opens the wiki on this Mac — until then, Reminders, the extension’s highlights and a research run on this Mac keep what they had. If it is a kind, or a source your other pages cite, what those pages took from it goes too (see Kinds and locked pages). Three things keep its words, as they always have: your Ask conversations, which are your own record, kept as you had them (locked with the wiki’s password when the wiki has one); pages made from it before it had its password — a page made from a selection of it, a Map of Content, a synthesis — which keep the words they were made with, as any page you wrote does; and MojoPad’s own backups. A backup is a complete copy of the wiki, made when it opens, once an hour while it changes, and with File ▸ Back Up Now, so the ones made before the page had its password hold its words without that password (sealed with the wiki’s own password when the wiki has one). Nothing offers to remove them. They go on their own as newer copies take their place — Copies to keep of each document in Settings ▸ Files & Backups says how many are kept, eight unless you changed it — or choose File ▸ Show Backups in Finder and delete the ones made before you gave the page its password.
Nothing makes another page from its words. Even while it is unlocked, on a page with a password
of its own Create Page from Selection, Explode Page…, Move Selection to Page…, an outline's
Move Row to…, Send Selection to Today and a block's or a canvas sticky's Send to today, a note's
Make a page, a sticky's Make page…, Duplicate Page, Save as Template…,
✦ Outline this page, ✦ Draft from this outline and Save Selection as Snippet… each say why and do
nothing, as do a map's ❖ and ↗, Save Mindmap as Outline and a storyboard's Send to…, and
Copy a Page in Here when you pick such a page; so does a selection that reaches into such a page shown inside
another, or that takes in such a page whole — one made across panes, say, or over the whole window with Select All
— and a new page of a Kind with a password of its own starts empty. Each would have put the words into a page
— or, for a snippet, into the wiki's styles — without that password. A page given its password while a
model is still writing from it puts nothing into another page either, and neither does one that locks
meanwhile, or one whose Kind, or another page it takes words from, is given a password meanwhile:
Write them in in Insert from Your Sources… writes nothing in, a Map of Content page you
gather on the graph is not made, nor is an index the graph builds from it — with Build an index… or
by ⌘-clicking a territory — and ↻ Rebuild leaves an index as it was; on a mind map,
❖ Ask about this, and keep the answer makes no page and ✦ Ask what branches from here adds nothing to the
map, when you chose From pages I pick or Both; Synthesize notes stops and makes no note;
✦ Grow, or a question you type into a board’s card, puts no answer on the board; ✦ Outline this page
makes no outline when its kind is given a password meanwhile, and in the same case ✦ Suggest tags, ✦ Fill with
AI (✦ Suggest properties in a wiki with none yet) and a property’s ✦, whether a model answers
it or one of your servers, offer nothing they wrote from the page, Tag in the graph’s Find issues to
fix puts no tags on it, and ✦ Fill on the pages of this kind… leaves that page as it was; ✦ Break it down on a
task adds no sub-tasks;
after the Journal’s ✦ Reflect, ↳ Insert into today adds nothing to today’s note; and a research run you gave the page to stops, and what
it found is not made into a page. In the Ask panel, an answer written from a page with a password of its own —
given it while the answer was being written, or at any time since — is not saved as a page with ↳ Save as
Page, put into another page with ⤵ Insert, or saved as one page with the rest of its conversation
(↳ at the top of the panel); nor is an answer written from a page whose kind, or another page it takes words
from, was given a password after you asked and since you last opened the wiki. For a page the answer read but does
not list, both hold only for an answer written since you last opened the wiki. The conversation itself keeps the
answer, as your own record. A research
run you gave pages to also stops when the wiki itself is given a password
while it runs: its copy of the pages is deleted, and what it found is not made into a page. Each says why. To work with
them elsewhere, link to the page from another: embedded there (Embed a Page, or ![[…]]), it shows
only that it has a password, never its words, even while it is unlocked.
Where you were in it is not kept, either. When you reopen a wiki, MojoPad puts you back where you were — the caret in the page you were in, the place in each paper or book, where each column’s thread starts — and for that it keeps, on this Mac and outside the wiki, the caret in each page you have open, the place in each paper or book and where each thread starts. For a page with a password of its own it keeps none of it: the page comes back in its tab, on its lock screen, and once you unlock it, it opens at the top. What MojoPad kept about the page before it had its password goes as soon as MojoPad sees the page is locked, including what it kept from before you moved or renamed the wiki. Nor does it keep where you were in a page once the page leaves the wiki — moved to the Trash or to another wiki, or deleted — whether it has a password or not.
Its saved versions are deleted at that moment, and this cannot be undone. Every earlier draft of that page was sitting on disk as plain text — encrypting the page while leaving its history beside it would protect nothing at all, so the history goes. MojoPad says so when it happens. If some earlier draft matters more than the secrecy does, copy it out before you encrypt. (A password on the whole document behaves differently — see below — because there it can encrypt the history rather than destroy it.)
File ▸ Set Document Password… protects the whole document: every page's name and content is encrypted at rest, and the document demands the password when opened. Change or remove the password from the same menu (you'll need the current one). There is no recovery — MojoPad never stores your password; a forgotten password means the content is gone. That's the point.
If you keep the wiki on more than one Mac, set, change or remove its password only while the wiki is closed on the others. The other Macs pick up the change the next time they open it. Changed while the wiki is open on two Macs at once, a page saved on one of them in the moment the change is still arriving can end up locked with a password neither Mac holds any more (see On a shared or synced drive).
What's covered, precisely. Page names and page content, of course — but also everything about your writing that is just as telling. The rule is now the other way round from where it started: a page keeps nothing readable except the machinery needed to list and unlock it, and anything new is covered by default rather than having to be remembered. So that means your text and titles, aliases and tags, the notes and synopsis you keep beside a page, the names of files you attached, the path of any file a page mirrors, the text pulled out of your PDFs and books, your reading highlights, video transcripts, page icons and cover pictures — and, in the document as a whole, your folder tree and every page title in it, your belief stamps (the sentences you wrote about changing your mind), your task areas, projects, goals and labels, your territory names, the paths of folders the document follows, which pages you pinned, and the links you drew between pages by hand.
And where you left it. So that you come back where you were, MojoPad keeps on this Mac, outside the wiki, which pages were open in each pane, each tab’s Back and Forward, the caret in each page you have open, the place in each paper or book, and where each column’s thread starts. For a wiki with a password all of that is locked with the wiki’s password too. What was kept before the wiki had its password, or by an earlier version of MojoPad, is locked the next time you unlock the wiki here — at once, when you set the password here — and what was kept under the name and place the wiki had before you moved or renamed it is removed then, unless something is at that place again, such as a copy of the wiki still arriving from another Mac, or that place is on a disk that isn’t connected to this Mac at the time, where the wiki, or a copy of it, may still be. While a password set on another Mac is waiting to be unlocked here, MojoPad keeps nothing of where you are in that wiki.
And your history, which is the part people forget. MojoPad keeps saved versions of your pages, and a saved version is a complete copy of a page as it was earlier. Setting a password takes all of them too, along with your saved conversations, the meaning index, the text pulled from your books, and the earlier looks kept for your page styles (MojoPad keeps the look each save replaced) — including versions of pages you have since deleted, which is exactly the history somebody would want. It used to be that locking a document protected the pages and left the history beside them readable, so a wiki you had kept for months was sealed at the front and open at the back. Now the lock takes everything, in one go, at the moment you set the password. If any of it can't be taken, MojoPad tells you how much, and what kind — a saved conversation, an earlier look kept for your page styles, saved versions of your pages, or the search text built from them. For a conversation, for saved versions and for the search text, setting the password again tries once more. A look is different, and MojoPad says so at the time: while the password is on it leaves any unlocked look alone, because it cannot tell one of yours from one somebody else put there — so setting the password again will not reach it, and removing the password and setting it once more is what does. A conversation is the one whose absence you would notice: it is not lost, but if you have just changed the password it stays under the old one and will not appear in your conversations until this succeeds, and if you have just set a password it is still readable without it. MojoPad will not report a document as protected while part of it is still readable.
What deliberately stays readable is the machinery a locked document needs in order to be unlocked: which version of the format it is, when it was created and last changed, how many pages it has, and the scrambling data the password is checked against. Someone with the file and no password can see that a MojoPad document exists and roughly how big it is. They cannot read a word you wrote, or what any page is called.
What is not covered, and this matters: whole files you brought in. A PDF you attached, a snapshot of a web page you clipped, an audio or video recording — the page about them is encrypted, but the file itself sits inside the document package unencrypted, and its own name is taken from the title it arrived with. Someone with the document and no password cannot read your notes on a paper, but they can open the paper, and they can see from the name what a snapshot was of.
So a document password is not the right tool on its own for a file that is itself the secret. For that, use FileVault, which every Mac has, so the whole disk is encrypted when it is off or locked — and keep in mind that a document password protects what you wrote, which is a different thing from what you collected. Encrypting the attachments themselves is coming; until it does, this page would rather tell you than leave you to assume.
Opening one of those files in another app. The app that opens a file keeps copies of its own on your Mac — its autosaves and its list of recent files — and MojoPad cannot reach them to clean them up. So in a wiki with a password, or on a page with a password of its own, MojoPad asks every time before it hands a file to another app, and nothing is handed over until you say yes. Edit Page in External Editor asks too, before it writes anything: your editor gets a copy of the page with no password while you work. That copy is kept in your Mac’s temporary folder, readable only by you, and MojoPad deletes it as soon as the page or the wiki locks, and when you close the window or quit; a copy left behind by a crash is deleted the next time MojoPad starts (see External Editors).
Documents you locked with an earlier version of MojoPad are brought up to this the first time you unlock them — no action needed, and the password doesn't change.
Settings ▸ Security ▸ Re-lock encrypted content: after 1, 5, 15, or 60 idle minutes, unlocked encrypted pages lock themselves (their plaintext is dropped from memory at once, on a Mac even while MojoPad is hidden or another app covers its window; while the display sleeps or the Mac is locked, anything of it that is left goes when the window is next drawn) and password-protected documents close — except one with changes waiting on the bar that says it was changed on another device, which is covered by its lock screen instead and stays open behind it, so those changes can still be saved (see On a shared or synced drive). A wiki whose password was set on another Mac while it was open here, and not yet unlocked here, is covered by its lock screen too (see Two Macs and a password). Off by default; recommended on a shared Mac. When a page or a wiki locks this way, the copy of a page your external editor was working on is deleted too (see External Editors). And whatever you had going on a page that locks stops with it: Presentation Mode, Read Aloud, Walk the Board and Dictate into Page, Quick Look on one of its pictures, and a menu opened on something in it; dictation says on the status line that it stopped, and why. A dialog left open when a page or a wiki locks closes too, as if you had pressed Cancel, so nothing it was asking about is done afterward — except the question a new wiki asks, How will you use this wiki?, which is asked again the next time the wiki opens. A dialog that was to add something where you were writing says on the status line that nothing was added, and why: its page locked, or a lock closed the dialog. Only a card showing the progress of something you started stays and keeps going, such as an import, an export, a model download, a synthesis being written, or an audio memo being recorded. A memo stops when the page it is being recorded into locks, and none of it is kept; a synthesis stops, making no note, when one of the notes it is written from locks; and either one says so.
With the wiki open in more than one window — a second window, or a reference card — each window keeps its own time, and a page locks in a window once that window has been idle. It stays open in any other window you are still using there, so the one you are writing in never loses what you type to a window you left alone; once every window has gone idle, the page is locked everywhere and the next read asks for its password again.
If a page ever is locked before your latest change to it could be saved, MojoPad says so at once and shows the page locked, rather than letting you keep typing into a page that cannot keep it.