Protected Text &
Secure Online Notepad
Write notes online, protect sensitive text, and keep your information private with Inkrypt. Use our secure online notepad to create password-protected notes whenever you need them.
No signup required • Private text protection • Easy online notes
AES-256 GCM
Why users trust Inkrypt
Inkrypt is designed for people who need a simple way to write and share private notes online. Security is built into the product from the start, not added as marketing tags.
Encrypted in your browser
Notes are encrypted with AES-256-GCM before they leave your device. Our servers only store ciphertext.
We cannot read your notes
Inkrypt uses zero-knowledge encryption. Passwords are never stored, so only people with the password can decrypt content.
Built for real privacy needs
Share sensitive text with expiry times, view limits, and optional passwords. No account is required.
How Inkrypt Works
Secure Online Notepad
Inkrypt is a free online notepad that uses browser-based, client-side AES-256 encryption to protect your text. Whether you need an online notebook for personal thoughts or a secure place for secret text, your password never travels to our servers. Your plaintext is never stored anywhere. Here's how our notepad online works.
Secure Notepad
Create Your Online Note
Type a unique notes page URL and click Go. For a new note online, you'll create it fresh. Existing note? You'll be prompted for the password.
Secure This Note
Set a password to encrypt the contents and create your private workspace.
Set Password Protected Notes
Your password acts as the AES 256 encryption key. We never store your password, ensuring your private text remains truly secure in our online notebook.
Title
Write here...
Write & Protect Secret Text
Write, format, and auto-save your private online notes. Use the Share button to send self-destructing links of your protected text with expiry times.
Self-Destructing
Notes & Secret Links
Inkrypt's sharing system is built for sensitive information. Create self-destructing encrypted share links with expiry times, view limits, and optional passwords. When your note has been seen enough, it vanishes. No logs, no traces.
"Shared notes are encrypted snapshots. They are read-only views where recipients cannot edit the original note, but you can share updated versions anytime, keeping long-term control."
Custom Expiry Times
Set exactly when your shared encrypted link expires by picking a date and time. The link automatically becomes inaccessible when the window closes. Ideal for sharing temporary credentials.
Optional Share Password
Add an independent password layer to every share link. This is separate from your note's main password. Even if the URL leaks, your encrypted note content stays protected.
View Limits
Restrict your shared note to a set number of views. Set it to a single view for a true one-time secret link. Once the limit is reached, the link self-destructs.
Why Use Inkrypt for Online Notes?
Private Notes
Keep private text away from unwanted access and create notes that are meant only for you.
Protected Text
Protect important text with password protection so your sensitive information stays secure.
Write Notes Online
Use Inkrypt as your everyday online notepad for quick ideas, reminders, drafts, and personal notes.
Easy and Free
Create online notes instantly with a clean, simple, and free online notepad experience.
How it works
What happens between typing and storing
Four steps, all of them in your browser. Nothing readable leaves your device.
You write and set a password
The password is the only input to the encryption key. It is never transmitted, never logged, and never stored — not even as a hash.Your browser derives a key
A 256-bit key is stretched from your password using PBKDF2-HMAC-SHA256 at 310,000 iterations, with a fresh random salt. This is the brief pause you notice on save — it costs any attacker the same on every guess.Your browser encrypts the text
AES-256-GCM produces ciphertext plus an authentication tag, so later tampering is detected rather than silently decrypted into altered text.Only ciphertext is uploaded
Our servers receive the encrypted blob, the salt and the IV. They perform no cryptographic operation and hold nothing that could decrypt it. See the full walkthrough.
You can check this in thirty seconds
Why it matters
Why encrypting in the browser changes who you have to trust
Almost every service encrypts your data. The question that decides everything is who holds the key.
In the usual arrangement, your text travels to a server over TLS and the server encrypts it before writing it to disk. That is genuinely useful — it defeats a stolen hard drive and a network eavesdropper. It does not defeat the service itself, because the service holds the key and handles your plaintext in memory on the way through.
Everything that touches that moment becomes part of your exposure: application logs, error reporting, performance monitoring capturing request bodies, a debugging session someone left running. None of it is malicious. All of it is plaintext.
Encrypting before the network removes the moment entirely. There is no window in which our infrastructure could see your text, so there is nothing for a log or a breach or a subpoena to reach.
| Stage | Server-side encryption | Inkrypt |
|---|---|---|
| You type it | Plaintext on your device | Plaintext on your device |
| Leaving your browser | Plaintext, wrapped in TLS | Ciphertext, wrapped in TLS |
| At the server | Plaintext, briefly readable | Ciphertext — unreadable to us |
| Written to storage | Encrypted with the provider's key | Already encrypted with yours |
| Who can read it | You and the provider | Only whoever knows the password |
The full comparison, including when server-side encryption is the better choice, is in client-side vs server-side encryption.
Security architecture
The exact parameters, published
These are the values in the shipping code. We publish them so the design can be evaluated rather than taken on faith.
| Cipher | AES-256-GCM |
|---|---|
| Key derivation | PBKDF2-HMAC-SHA256 |
| KDF iterations | 310,000 |
| Salt | 16 bytes, random, per note |
| IV | 12 bytes, random, per operation |
| Authentication tag | 128 bits |
| Implementation | Web Crypto API (SubtleCrypto) |
| Runs on | Your device |
Field-level detail on what the database holds, plus the reasoning behind each parameter, is on the security architecture page.
Threat model
What this protects you from — and what it does not
A security tool is only meaningful relative to a specific adversary. Here is ours, including the parts where we fall short.
| Adversary | Defended | Why |
|---|---|---|
| A breach of our database | Yes | We hold only ciphertext; no master key exists |
| Network interception | Yes | Plaintext never enters the network |
| Us, the operator | Yes | No key ever exists on our infrastructure |
| A legal demand for content | Yes | We can only produce ciphertext |
| Someone with only the share link | Yes | The link retrieves ciphertext; the password is separate |
| Offline password guessing | Partial | 310,000-iteration KDF, but bounded by your password |
| Malware on your device | No | Plaintext exists before encryption runs |
| The recipient copying it | No | Outside any technical boundary |
| A forgotten password | No | Deliberate — recovery would mean we hold a key |
If the bottom rows are your problem, use something else
Who uses it
Where an encrypted note is the right tool
Not a password manager, not a document editor, not a messenger. Good at one specific thing.
Encrypted notes fill a narrow gap: getting a piece of sensitive text from you to someone else, once, without leaving a permanent copy in an inbox or a chat log. Almost every situation below is a variation of that.
- Developers handing over an API key or connection string that would otherwise sit in Slack forever.
- IT and DevOps teams doing onboarding, contractor access and emergency handoffs.
- HR and recruiting sending offer details and personal data without a permanent copy in two mailboxes.
- Agencies and freelancers exchanging client credentials across organisations that share no tooling.
- Personal use — shared logins, travel details, and private drafts you would rather not leave in a chat history.
When to use something else
Transparency
Why you should be sceptical, and what we publish because of it
Every privacy product claims to protect you. That claim is worth exactly as much as your ability to check it.
We cannot prove our good intentions, and you should not extend them on the strength of a marketing page. What we can do is publish enough specific, checkable detail that you do not have to rely on trust — and be explicit about the places where our design falls short.
- Full security architecture — every algorithm and parameter, plus exactly which fields our database holds.
- An explicit threat model that lists what we fail at, not only what we defend against.
- An editorial policy covering sourcing, technical review, corrections and review cadence.
- A responsible disclosure policy with response times we can actually meet.
- A changelog recording security and privacy decisions, including the trade-offs still open.
- A cookie policy listing every cookie and storage key by name.
Things we state plainly rather than bury
Use Inkrypt as Your Private Online Notebook
Protect Your Notes and Sensitive Text
Inkrypt helps you create private online notes and protect sensitive text before sharing or saving it. Use it for personal information, temporary passwords, confidential drafts, and other text you want to keep private.
Latest Insights on Encryption & Online Privacy
Explore our latest guides on zero-knowledge encryption, client-side security, and self-destructing notes. Learn how AES-256, browser-based encryption, and expiring messages protect sensitive data for individuals and teams worldwide.
How to Share Passwords Securely Online
Learn the safest ways to share passwords online, why sending plain text credentials via email or chat apps is risky, and how secure sharing tools help protect your data.
Self-Destructing Notes vs Encrypted Email: Which Is Safer?
Learn the difference between self-destructing notes and encrypted email, when to use each for sensitive information, and how to protect confidential data.
AES vs RSA Encryption: What Is the Difference?
Learn the core differences between AES vs RSA encryption. Understand symmetric vs asymmetric keys, AES-256-GCM, and how hybrid encryption secures your data.
Free Encrypted Notepad Online –
Secure, Private & Zero-Knowledge
Inkrypt is a free encrypted notepad online that lets you create, store and share secure notes with end to end AES 256 encryption. Unlike traditional note apps, all encryption happens inside your browser, ensuring complete zero knowledge privacy. No signup required, no tracking, and no plaintext storage for truly private note sharing.
No Signup Required
Create secure encrypted notes instantly without creating an account. No email, no login, and no personal data collected for private note sharing from any browser.
Self-Destructing Notes
Generate self-destructing note links that automatically expire after a specific time or number of views. Perfect for sharing confidential messages safely.
Password-Protected Links
Add an extra password layer to your encrypted note links. Even if someone accesses the URL, your private message remains protected.
Client Side AES 256 Encryption
All encryption happens locally in your browser using AES 256 client side encryption. Your password and plaintext data never reach our servers, ensuring true zero knowledge security.
Works on All Devices
Inkrypt is a responsive secure online notepad that works on any device and any modern browser. No downloads, no installations, no platform restrictions.
Frequently Asked Questions About Inkrypt
Learn more about how to use our free online notepad and keep your private notes secure.