Encryption

Encryption is optional and off until you turn it on. With it on, your notes are encrypted before anything reaches the disk, and you are asked for a passphrase when the database is opened.

Turning it on

Encryption lives in the application’s notes preferences, alongside the storage format. Two things to know before you enable it:

1. It requires the single-database storage format. Notes stored as individual files cannot be protected this way. If you are using an individual-file format, the application will ask you to switch.
2. The passphrase is the key. It is not a password checked against an account somewhere — your notes are encrypted with keys derived from it. There is no recovery route, no reset link, and no back door. If you lose the passphrase, the notes are gone.

You can store the passphrase in your macOS Keychain so you are not asked on every launch, or leave it out of the Keychain and type it each time. Kinetic Notes uses its own Keychain item, separate from Notational Velocity’s, so changing a passphrase here cannot affect a database that application still depends on.

Changing the passphrase later re-derives the keys; you do not have to export and re-import.

What is protected

With encryption enabled:

• Note content and metadata. Neither is written to disk in clear text, even temporarily.
• The write-ahead log. The file holding changes not yet folded into the database is encrypted with keys ultimately derived from the same passphrase — so recent edits are not sitting in the open while older ones are protected.

Everything is also compressed before it is encrypted.

How the keys work

Kinetic Notes uses AES-256 in cipher-block chaining mode, through Apple’s CommonCrypto. Notational Velocity used OpenSSL’s implementation of the same cipher; version 1.0 replaced the dependency, and the format is unchanged — databases encrypted by Notational Velocity still open.

Three keys are derived, not one:

1. A master key, derived from your passphrase with PBKDF2 and a random 256-byte salt, using as many iterations as your CPU can complete within a time budget you choose. A slower setting means a slower brute-force attempt against your notes.
2. A data session key, derived from the master key with its own random salt.
3. A verifier key, derived from the master key with a third salt, used to check that the passphrase you typed is correct without decrypting anything.

You can also raise the key length in the preferences, and the salts and iteration count are stored with the database so it stays openable on another machine.

What it does not protect against

Being straight about the limits is part of the feature:

The full technical description of the original design is in Notational Velocity’s Database Security documentation, and the implementation is in the source if you would rather read it than take our word for it.