Don't take our word for it

Check 1 — Look at what your cloud actually holds

What to do

1. In Lyunotes, make two notebooks: one with encryption on, one without.
2. Put a note in each with the same made-up line, like SECRET-TEST-12345.
3. Wait for your cloud to sync, then open its website (Dropbox, OneDrive, iCloud…) and find the two notebook folders.
4. In each notebook folder, download the file called notes.db. That's the notebook's database, where the notes live.
5. Open it in a plain text editor and search for your made-up line.

What you'll see

Unencrypted notebook: your line shows up, along with titles and more. Anyone who can open your cloud account can read it.

Encrypted notebook: no match. It looks like random characters. An unencrypted database starts with the readable text SQLite format 3. These are the first bytes of an encrypted notebook's database, with no readable text at all:

fe58 9901 738b 7ff6 f240 aeb1 a34b 139a
16d7 c727 264e b0ca aedb 1504 ad57 5258

We ran this check ourselves on test notebooks in OneDrive. We searched every file in an encrypted notebook's folder for a made-up notebook name, note title, note text, tag, folio name and attachment name. None of them appeared anywhere.

What you can still see (we don't hide this)

What stays visible

Encryption protects what's inside your notes. It doesn't make the folder invisible.

Anyone who can look at your cloud folder can still see:

• that your encrypted notebooks exist, and how many there are
• how many notes each notebook holds, the size of each note and attachment, and how many attachments a note has
• when things were last changed, including when earlier versions and backup copies of a notebook were made
• the lock-screen name, emoji and cover color you pick for a notebook. These are stored readable so the app can show them while the notebook is locked, so pick something that doesn't give anything away
• roughly how long a notebook's real name is, and which theme it uses, because both can be guessed from the size of the encrypted entries
• folder and file names, but not your notebook or note names: they are random strings or fixed names the app uses

What stays hidden

In an encrypted notebook: the notebook's name, the titles and text of your notes, tags, folios, and the names and contents of attached files.

How your password protects the key

What's stored

Your password is turned into an encryption key with Argon2id, a deliberately slow, memory-hungry method. The notebook's master key is stored wrapped (encrypted) by that password-derived key, and separately by your recovery key. The wrapped keys and a random salt sit in the notebook's settings, so anyone who can read your cloud folder can see them. Copies of the recovery key's wrapping also sit in a few other notebook files.

Your notebook password is never stored. The master key itself is never written to your notebook files and never sent anywhere. On Windows it is held only in the app's memory while the notebook is unlocked. On iPhone, if you turn on biometric unlock, it is kept in that device's Keychain only, protected by Face ID or Touch ID and not synced to other devices. (If you set an app-lock PIN, only a scrambled hash of it is stored on your device.)

What this means

In principle, someone with a copy of your files could try passwords offline, guessing one after another. Argon2id makes each guess slow and costly, but the protection is only as strong as your password. Use a long, unusual password. Your recovery key is a long random value, so guessing it isn't realistic. Keep it somewhere safe and never share it. If you lose both, nobody can open the notebook, including us. More: Your password and recovery key.

Check 2 — See who the app talks to

What to do

1. Install any network monitor that shows which servers an app connects to.
2. Use Lyunotes for a while: write, save, sync.
3. Look at the list.

What you should see

• Your own cloud, the one you picked.
• Update check (Windows): the app fetches a small file from lyunotes.com that says what the latest version is. It sends no notes, keys, account information or device identifier. As with any website visit, the usual details of a web request reach our web server and may appear in its access logs, which are kept for a limited time: your IP address, the time, and the name and version of the update library the app uses to ask. If you choose to update, the installer is downloaded from the address listed in that file. The Windows app has no analytics or crash reporting.
• Sign-in and license check (iPhone, optional Glyph purchase): proof of purchase, your device's ID and model. No notes, no keys.
• Update check (iPhone): a small file from Google's hosting that says the minimum version, and a lookup at Apple's App Store, which includes your store's country.
• Apple, for purchases (iPhone).
• Another website, only if you paste an image link into a note and the app fetches that image.

The details are in our Privacy Policy.

No independent audit yet

Why this page exists

Lyunotes is closed-source and has not had an independent third-party security audit. That's exactly why this page exists. Check it yourself, and see what Lyunotes doesn't do. Found something that doesn't match what we say? security@lyunotes.com

Last checked: October 2026.