MojoPad

Encryption and Privacy

Some notes are nobody's business. MojoPad encrypts at two levels, both with AES-256-GCM and scrypt key derivation — modern, audited primitives.

Encrypting a page

Edit ▸ Encrypt Page… (⇧⌘E). Choose a password (and an optional hint). From then on the page's content exists on disk only as ciphertext. Locked pages show a lock screen in the editor and a 🔒 in the page list, and they are excluded from search, linking, exports, AI indexing, the web server, and Static Publishing — no leaks through side doors. Unlock with the password; the page stays unlocked until the document closes (or the re-lock timer fires).

Its saved versions are deleted at that moment, and this cannot be undone. Every earlier draft of that page was sitting on disk as plain text — encrypting the page while leaving its history beside it would protect nothing at all, so the history goes. MojoPad says so when it happens. If some earlier draft matters more than the secrecy does, copy it out before you encrypt. (A password on the whole document behaves differently — see below — because there it can encrypt the history rather than destroy it.)

Encrypting a document

File ▸ Set Document Password… protects the whole document: every page's name and content is encrypted at rest, and the document demands the password when opened. Change or remove the password from the same menu (you'll need the current one). There is no recovery — MojoPad never stores your password; a forgotten password means the content is gone. That's the point.

What's covered, precisely. Page names and page content, of course — but also everything about your writing that is just as telling. The rule is now the other way round from where it started: a page keeps nothing readable except the machinery needed to list and unlock it, and anything new is covered by default rather than having to be remembered. So that means your text and titles, aliases and tags, the notes and synopsis you keep beside a page, the names of files you attached, the path of any file a page mirrors, the text pulled out of your PDFs and books, your reading highlights, video transcripts, page icons and cover pictures — and, in the document as a whole, your folder tree and every page title in it, your belief stamps (the sentences you wrote about changing your mind), your task areas, projects, goals and labels, your territory names, the paths of folders the document follows, which pages you pinned, and the links you drew between pages by hand.

And your history, which is the part people forget. MojoPad keeps saved versions of your pages, and a saved version is a complete copy of a page as it was earlier. Setting a password takes all of them too, along with the meaning index and the text pulled from your books — including versions of pages you have since deleted, which is exactly the history somebody would want. It used to be that locking a document protected the pages and left the history beside them readable, so a wiki you had kept for months was sealed at the front and open at the back. Now the lock takes everything, in one go, at the moment you set the password. If any of it can't be taken, MojoPad tells you how much, and what kind — saved versions of your pages, or the search text built from them — and offers to try again. It will not report a document as protected while part of it is still readable.

What deliberately stays readable is the machinery a locked document needs in order to be unlocked: which version of the format it is, when it was created and last changed, how many pages it has, and the scrambling data the password is checked against. Someone with the file and no password can see that a MojoPad document exists and roughly how big it is. They cannot read a word you wrote, or what any page is called.

What is not covered, and this matters: whole files you brought in. A PDF you attached, a snapshot of a web page you clipped, an audio or video recording — the page about them is encrypted, but the file itself sits inside the document package unencrypted, and its own name is taken from the title it arrived with. Someone with the document and no password cannot read your notes on a paper, but they can open the paper, and they can see from the name what a snapshot was of.

So a document password is not the right tool on its own for a file that is itself the secret. For that, use FileVault, which every Mac has, so the whole disk is encrypted when it is off or locked — and keep in mind that a document password protects what you wrote, which is a different thing from what you collected. Encrypting the attachments themselves is coming; until it does, this page would rather tell you than leave you to assume.

Documents you locked with an earlier version of MojoPad are brought up to this the first time you unlock them — no action needed, and the password doesn't change.

The re-lock timer

Settings ▸ Security ▸ Re-lock encrypted content: after 1, 5, 15, or 60 idle minutes, unlocked encrypted pages lock themselves (their plaintext is dropped from memory) and password-protected documents close. Off by default; recommended on a shared Mac.

The wider privacy story

  • Your documents are local files. Nothing syncs anywhere unless you put it somewhere.
  • MojoPad's own AI features run on your Mac via Ollama — no page content leaves the machine. The one thing that changes this is Bring your own model, which is off until you turn it on and confirm: with it on, the pages behind a question you ask go to the provider whose key you entered. Everything automatic still runs here, and a page with a password on it is never sent — which makes a password the reliable way to keep something out of it. Before switching that on, read What "opening your wiki to a model" actually means in Local AI: a question sends the pages the retrieval judges related, not only the one you had in mind.
  • The meaning index is encrypted along with everything else the moment you set a password, including one built long before you set it — as are your saved page versions, the text taken from your books, your saved bulk edits and your desks. Setting a password on a document you have kept for years covers what is already there, not just what comes after.
  • If you connect an outside AI assistant of your own, that assistant is the one exception, and it's one you choose: what it reads goes wherever it sends it. See AI Agents for exactly where that edge falls and how to set it.
  • MojoPad phones home to exactly nobody.