Better note title behavior

Clearing a note title now keeps it empty instead of re-generating a title unexpectedly. We also adjusted the $headline$ formatting so the title is now derived from the first paragraph or heading instead of the whole note.

Improved tables on mobile

Table interactions are now smoother on mobile, including better cell selection, more reliable horizontal scrolling, and improved in-cell editing and text selection.

More predictable app launch behavior

The app no longer randomly jumps into the editor on launch and now opens more consistently to the notes list.

Other changes

• Fixed file size check shows error but continues adding the file to editor
• Note title headline format should get content from first paragraph
• Add reminders help page on help https://help.notesnook.com/reminders

Full Changelog: https://github.com/streetwriters/notesnook/compare/3.3.18-android...3.3.19-android

Improve UX on password reset flow

We've added some changes in the password reset flow for better user experience

1. The page will automatically redirect to login page after final step
2. Back buttons are added on each form
3. Better error messages when an invalid recovery key is inputted

Title $headline$ format change

After various user requests last year, we changed how the note title's headline format worked. It would extract content from all nodes (paragraphs, headings, lists) until it hit the 150 character limit. Users have been asking for a while to change this behavior, and after some reflection we've changed it to only get content from the note's first paragraph/title and up to 60 characters.

Various bug fixes

1. Fix callout's first heading being collapsed/expanded when clicking right next to it
2. Fix plans page being cut off from the top
3. On change email, refresh the user so the new email is instantly visible. Also fixed the change email OTP timer not running on first attempt
4. Handle crash on preview attachment
5. Perform fuzzy search again if query contains non-alphanumeric characters
6. Guard against undefined backStack/forwardStack in TabSessionHistory
7. Fix HTML entities being shown in match result

Full changelog: https://github.com/streetwriters/notesnook/compare/v3.3.12...v3.3.13

Fix attachment uploads for new user signups

We identified an issue where new users signing up for Notesnook and immediately trying to upload attachments would encounter ciphertext cannot be decrypted using that key error. This was due to multiple attachment encryption keys being generated. We have fixed this issue by ensuring that the attachment encryption key is generated during the signup process instead of on the first attachment upload.

Other fixes

• Fix undefined id crash in subscription product items on iOS

Full Changelog: https://github.com/streetwriters/notesnook/compare/3.3.17-android...3.3.18-android

UX improvements

1. Pasting images from clipboard now properly checks if you are logged in before attempting to upload the image.
2. Sending email verification now shows toasts for success and failure states.
3. The navigation bar on the web app no longer un-collapses when a menu is still open.

Fix attachment uploads for new user signups

We identified an issue where new users signing up for Notesnook and immediately trying to upload attachments would encounter ciphertext cannot be decrypted using that key error. This was due to multiple attachment encryption keys being generated. We have fixed this issue by ensuring that the attachment encryption key is generated during the signup process instead of on the first attachment upload.

Full changelog: https://github.com/streetwriters/notesnook/compare/v3.3.11...v3.3.12

Improved note switcing

Note switching has been improved to remove the flicker and make it feel smooth.

Search improvements

Support for diacritic-agnostic search was introduced in v3.0.18. However, it was not handled correctly in the revamped search experience. This has now been fixed. Additionally, a bug that caused searches with certain special characters (such as [ or \) to return empty results or crash the app has been resolved.

Special word separator handling has also been improved across all areas using fuzzy search (including notebooks, tags, and attachments). For example, searching for “a b” will now return variations like “a_b” and “a-b”.

Security patches

We received one security reports this month, which has been addressed:

1. Note titles were not properly escaped when sharing to Notesnook using Share Extension. This could allow malicious HTML in user-generated titles to execute. Titles are now safely escaped before rendering. (Thanks Nolan42 for responsible disclosure!)

No action is required beyond updating to this version.

Other fixes

1. Fix iOS app remains stuck when restoring backup from list of backups in the app or when creating a backup
2. Allow secure local https with user installed CA on android
3. Fix app gets locked when requesting notification permission for upload progress
4. Add missing telegram icon in Settings
5. Fix linked note not opening from attachment properties
6. Fixed top bar items in note properties show irregular space and do not follow pagination rules. Each page should fill the whole width of the available space.
7. Unlocking a locked note that is not in any vault has been fixed now
8. You can now preview and resolve merge conflicts in locked notes

Desktop fixes

1. Disabling auto-update in settings now also disables the update checker. The app will no longer check for updates automatically.
2. An issue with YouTube embeds not working was addressed in previous releases; however, “Error 153” persisted on Desktop. This has now been fully resolved.

Search improvements

Support for diacritic-agnostic search was introduced in v3.0.18. However, it was not handled correctly in the revamped search experience. This has now been fixed. Additionally, a bug that caused searches with certain special characters (such as [ or \) to return empty results or crash the app has been resolved.

Special word separator handling has also been improved across all areas using fuzzy search (including notebooks, tags, and attachments). For example, searching for “a b” will now return variations like “a_b” and “a-b”.

Security patches

We received two security reports this month, both of which have been addressed:

1. Note titles were not properly escaped in the web and desktop diff viewer. This could allow malicious HTML in user-generated titles to execute. Titles are now safely escaped before rendering. (Thanks Ngocnn97 for responsible disclosure!)
2. Notes created via the web clipper could include malicious scripts within iframes. This issue has been fixed by securely sandboxing the clipped content. (Thanks Ngocnn97 for responsible disclosure!)

No action is required beyond updating to this version.

Other fixes

1. Escape command titles in command palette
2. Fix editor title temporarily flickering on tab switch
3. Fix feature title margin in feature dialog
4. Remove vertical offset on link hover popup
5. Fix typo in import result text

Audio attachment playback

You can now play audio files directly inside your notes without downloading them first. Audio attachments render as an inline audio player, so you can listen to voice memos, recordings, or any other audio file right in the editor.

To attach an audio file, use the attachment menu in the toolbar and select your audio file. It will appear as a playable widget in your note.

Attach images as files

Images can now be inserted as file attachments instead of being embedded inline. This is useful when you want to keep an image alongside your note without it taking up space in the editor view.

To attach an image as a file, open the attachment menu in the toolbar and choose the file option when inserting an image.

Code block language memory

The editor now remembers the last-used code block language and pre-selects it the next time you insert a code block. This saves time when writing multiple code blocks in the same language throughout a note.

Sort assigned tags to top on mobile

When viewing or editing the tags of a note on mobile, tags already assigned to the note now appear at the top of the list. This makes it much easier to manage tags without scrolling through the full tag list.

Delete data for logged-out users

Users who are not logged in can now delete all local app data from the settings. This is useful for clearing notes and data from a shared or temporary device without needing an account.

Find this option in Settings under "Delete data".

Other improvements

1. Improved horizontal rule styling — Horizontal rules in the editor are now thinner and more refined, blending better with your content
2. Reminder dialog improvements — The reminder dialog has been redesigned for a cleaner and more consistent experience
3. Reduce editor title padding — Editor title & content on web and desktop now uses consistent sizing and padding for a more compact look
4. Prioritize environment variables for server URL — Self-hosters can now override the server URL via environment variables, which take priority over other configuration

Fixes and improvements

As with all our releases, we've fixed a range of bugs and improved overall stability. Here are the notable fixes:

1. Fixed external links opening inside the app instead of the default browser on desktop (thanks @Copilot reviewed by @thecodrr!)
2. Fixed vault not being marked as created when locking a note for the first time
3. Fixed vault not being marked as created on login when it already exists
4. Fixed attachment not marked as uploaded after lock/unlock
5. Fixed web and desktop app crashes (thanks @thecodrr!)
6. Fixed crash on drag-and-drop file in Flatpak build
7. Fixed text not being selectable across the full editor height (thanks @keysmashes!)
8. Fixed unable to change zoom level back to 1.0 (thanks @littleKitchen!)
9. Fixed toolbar item indentation when moving between groups (thanks @ArjunCodess!)
10. Fixed properties panel rendering for locked sessions
11. Fixed check icon alignment in note color properties panel
12. Fixed font family being lost on new lines (thanks @thecodrr!)
13. Fixed backticks creating inline code even with Markdown Shortcuts disabled (thanks @Copilot reviewed by @thecodrr!)
14. Fixed TOC active heading detection for headings nested inside callout blocks (thanks @Copilot reviewed by @thecodrr!)
15. Fixed checklist and blockquote indent alignment
16. Fixed empty embed URLs and code being allowed in embeds
17. Fixed archived notes not appearing in attachment linked notes
18. Fixed account password changing (thanks @thecodrr!)
19. Removed orphaned attachments during trash cleanup
20. Fixed random crash when opening a notebook on mobile
21. Fixed toast context in the color picker on mobile
22. Fixed attachment upload error ("Failed to delete file") on mobile
23. Fixed note loading getting stuck on mobile
24. Fixed foreground/background switch starting a new attachment cache download group on mobile
25. Fixed vault with biometrics enabled not locking the note on mobile
26. Fixed note title being editable in read-only mode on mobile
27. Fixed native Android crashes found in Play Console vitals
28. Fixed reachability URL on mobile

Security fixes

1. Fixed HTML escaping in Twitter/X embed source (thanks @x4sh3s for responsible disclosure!). No action required beyond updating to this version.

Read the full commit history.

Expiring notes (Pro)

Notes can now expire automatically after a set date. When a note expires, it gets moved to trash. This is useful for temporary notes, drafts, or time-sensitive information that should be automatically cleaned up after a certain date.

To set an expiry date, open note properties and select "Set expiry date". You can set any date in the future, and the note will automatically move to trash when that date is reached.

Export/import tables as CSV (Pro)

You can now export tables to CSV files and import CSV files as tables directly in the editor. This makes it easier to work with spreadsheet data in your notes.

To export a table, right-click on it and select "Export to CSV". To import, use the same menu and select "Import from CSV".

Customizable editor line height

Control the spacing between lines in the editor with the new line height setting. Fine-tune the line height with float-level precision to perfectly match your reading preference.

Find this setting in Settings > Editor > Line height.

Android home launcher shortcuts (Pro)

Android users can now add shortcuts for notebooks, tags, notes, and colors directly on their home screen for quick access. Long press the Notesnook app icon and drag a shortcut to your home screen.

Day & week format settings

Customize how dates are displayed throughout the app with new day and week format options. You can now choose your preferred first day of the week and date format. Additionally, use the new $day$ title format and /day command for daily notes.

Edit note creation date

You can now edit a note's creation date from the properties panel. This is useful when importing notes from other apps or when you want to backdate entries.

New keyboard shortcuts

Several new keyboard shortcuts have been added to improve your workflow:

1. Move line up/down - Move the current line or selection up/down with Alt+Up/Down (Windows/Linux) or Option+Up/Down (Mac)
2. Clear current node - Remove formatting from the current node with Ctrl+Backspace (Windows/Linux) or Cmd+Backspace (Mac)
3. Save note - Quickly save from the status icon click or tab menu
4. Copy images - Copy images with Ctrl+C (Windows/Linux) or Cmd+C (Mac)
5. Command palette - Now accessible via a button in the status bar

Title in note history

Note history now includes the title in each session, making it easier to track changes to both content and titles over time. When viewing note history, you can see exactly what the title was at each point in time.

Other improvements

1. Multipart uploads on mobile - Improved reliability for large file uploads on iOS and Android
2. Customizable monograph title - Set custom titles for your published monographs
3. Preview attachments - Preview attachments directly in the attachment manager before downloading
4. Conflicts on locked notes - Sync conflicts now properly show on locked notes
5. Improved sync reliability - Various improvements to make syncing more reliable
6. Collapsible heading performance - Significantly improved performance when working with many collapsible headings

Fixes and improvements

As with all our releases, we've fixed a bunch of bugs and improved the overall user experience. Here are some notable fixes:

1. Fixed file picker and PDF preview issues on iOS and Android (thanks @ammarahm-ed!)
2. Fixed iOS crash when using biometric unlock
3. Fixed keyboard opening on app launch if locked note is opened
4. Fixed sidebar close gesture on iOS
5. Fixed color picker wheel images not loading
6. Fixed notification notes being created on every app launch
7. Fixed app crash when restoring invalid backup files
8. Fixed wrong trial end date shown in settings
9. Fixed editor and note title resizing when window resizes
10. Fixed TOC headings alignment (thanks @01zulfi!)
11. Fixed empty command palette/quick open when locked note is active
12. Fixed duplicate block-id on splitting nodes
13. Fixed desktop starting minimized on auto-startup
14. Fixed YouTube embeds erroring with code 153
15. Fixed icons not aligning in lists and callouts with custom line height
16. Fixed hidden collapse/expand icon when callout title is empty
17. Fixed web clip on mobile not including URL & date clipped
18. Fixed shortcuts not updating in side menu
19. Fixed share sheet bottom padding
20. Fixed search scroll not working on switching editors
21. Fixed reminder sorting and dialog formatting (thanks @NeedsChloesure!)
22. Fixed themes not installing and improved theme server performance
23. PDF previews now work correctly on iOS
24. Cleanup downloaded cache files on startup

Read the full commit history.

Wrapped 2025

Notesnook Wrapped 2025 is your personal recap of the year you spent with Notesnook. Available throughout December and accessible from the sidebar, it highlights your activity, stats and how you used Notesnook this year. Here's a sneakpeak:

All stats are generated 100% locally on your device, ensuring your privacy is preserved.

Don't forget to share your Wrapped 2025 with us on Discord and X!

Special thanks to @01zulfi for coming up with this idea and implementing it!

Monograph analytics

You can now see your Monograph's view count. Note: this view counts are recorded after this release.

Table improvements

Tables on mobile (and touch devices) have been significantly improved:

1. Resize columns directly via touch just like on web/desktop.
2. Cell selection now works as expected.

Many table related bugs were also fixed, including an issue where read-only tables couldn't be scrolled.

Editor improvements

1. Collapsible headings improvements - Fixed alignment issues with multi-line headings (works perfectly in both LTR and RTL), hide horizontal rules under collapsed headings, and better behavior when changing heading levels.
2. Improved inline code styling for better readability.
3. Completed checklist items now have a fade effect for better visual clarity.
4. Twitter/X embed support - You can now embed tweets directly in your notes.
5. Added search and replace shortcut (Cmd/Ctrl + Alt/Option + F).
6. Added text color toggle keybinding (Cmd/Ctrl + Alt/Option + C).

Attachment upload improvements on iOS/Android

Attachment uploads on mobile devices have been made much more reliable:

1. Uploads now continue in the background when you switch apps.
2. Show notification for in-progress uploads.
3. Improved overall upload reliability.

Fixes and improvements

As with all our releases, we've fixed a bunch of bugs and improved the overall user experience. Here are some notable fixes:

1. Fixed file uploading not working in Safari
2. Fixed file drag overlay stuck forever (now closable with click or ESC key)
3. Show spaces properly in note, notebook, tag, and reminder list titles
4. Fixed chunk calculation errors that could cause upload issues (thanks @needschloesure!)
5. Archive notes directly by dropping them on the Archive nav item
6. Fixed user keys re-encryption when changing password

Read the full commit history.

• Ente - private photo & video storage
• Addy.io - email aliasing service
• Kagi - private search engine

And now we are thrilled to add Tuta to this list of amazing partners.

Tuta is a secure email & calendar service that prioritizes user privacy. A lot of our users already use Tuta for their email needs, so this partnership was a natural fit.

As a paying Notesnook member, you can now get 25% off your first year on any Tuta plan. Similarly, Tuta users can now enjoy a 25% discount on the first year of Notesnook Pro plan.

How to Redeem

1. Open Notesnook
2. Go to Settings > Notesnook Circle
3. Click on "Redeem code" under Tuta
4. Use the direct link given to claim your discount. If that doesn't work, you can also append the code to this link https://app.tuta.com/signup/#token= as an alternative.

As a paying Notesnook member, you can now get 25% off your first year on any Addy.io plan. Similarly, Addy.io users can now enjoy a 25% discount on the first year of Notesnook Pro plan.

Read Addy.io's announcement here.

How to Redeem

1. Open Notesnook
2. Go to Settings > Notesnook Circle
3. Click on "Redeem code" under Addy.io

The discount code should be usable during checkout on Addy.io.

Notesnook & Ente

Ente is a privacy-focused and end-to-end encrypted photo and video storage service that ensures only you can access your memories. Ente shares our vision of a better, more private internet, and we are thrilled to have them as our second partner in Notesnook Circle.

As a paying Notesnook member, you can now get 25% off your first year of any Ente plan. Similarly, Ente users can now enjoy a 10% recurring discount on the Notesnook Pro Yearly plan.

To avail of this offer, simply visit the Notesnook Circle page and follow the instructions to redeem your benefits.

Unfortunately, on the Internet everyone and everything is isolated. Each service is trying to build its own walled garden; from Apple to Google to Facebook and Microsoft. This goal is starkly converse to what we as humans seek, because most of us don't fit into a single ecosystem. We use multiple services, our lives are scattered across a host of different apps, and we love the freedom to choose.

Wouldn't it be awesome if the services you loved to use, that you trusted, came together to form a united front for privacy? A coalition of apps and services that work together to protect your data, respect your privacy, and give you control over your digital life?

That's our vision behind Notesnook Circle.

Notesnook & Kagi

We are excited to announce our partnership with Kagi, a privacy-focused search engine that puts user experience and privacy above all else. Kagi shares our vision of a better, more private internet, and together we aim to create a seamless experience for users who value their privacy.

Aside: I have been personally using Kagi products, especially the Orion browser, for the past several months and it is one of the most fantastic browsing experiences I have ever had so I can't recommend Kagi enough.

As a paying Notesnook member, you can now get 3 months free of Kagi's Professional plan, which includes unlimited searches, Kagi Assistant, and more. Similarly, Kagi users can now enjoy a 10% recurring discount on the Notesnook Pro Yearly plan.

To avail of this offer, simply visit the Notesnook Circle page and follow the instructions to redeem your benefits.

Looking Ahead

This is just the beginning. We are actively working on expanding the Notesnook Circle by partnering with more privacy-focused services and apps. If you think some privacy-focused service would be a great fit for Notesnook Circle, please reach out to us at support[at]streetwriters.co. We would love to hear from you!

Our goal with Notesnook Circle is to prioritize quality over quanitity. We don't want to recommend something we would personally never use. A small but strong network of trusted partners who share our vision for a better, more private internet is far more preferable to an explosive list built only for marketing.

Filters in search

Search now supports field filters like:

• content: <text>
• title: <text>
• favorite: <true|false>
• pinned: <true|false>
• locked: <true|false>
• archived: <true|false>
• readonly: <true|false>
• tag: <text>
• color: <text>
• edited_after: <date>
• created_after: <date>
• created_before: <date>
• edited_before: <date>
• in_notebook: <true|false>
• tagged: <true|false>
• colored: <true|false>

The UX is still pretty raw but we are releasing this to gather early feedback. Consider it a beta feature.

Editor stats

You can now see the character count, word count, total spaces, and paragraphs count in the status bar below the editor.

Fixes and minor improvements

As with all our releases, we've fixed a bunch of bugs and improved the overall user experience. Thanks to our beta users you'll find this release much more stable and performant.

Read the full commit history here.

There's a lot that goes into keeping a product like Notesnook sustainable: from reducing our hosting costs to writing better code that requires fewer man-hours to maintain. But eventually, no matter what we do, we have to raise our prices in order to keep moving forward.

For context, Notesnook Pro has been offered at a really competitive price of just $4.49/mo. This includes unlimited storage (files & images), unlimited devices, monographs, the complete rich text editor experience, and anything else we might add in the future.

But as you can guess, this just isn't sustainable. First of all, our unlimited storage offering is truly unlimited (you can check the code!) which makes it impossible to maintain in the long term. We added this as a way to set us apart from what everyone else was offering, but I think Notesnook has grown to become so much more than its competitor without leaning on shiny labels like that.

Raising prices will help us keep Notesnook 100% private, independent, and sustainable — no investors, no ads, no data selling. Every dollar will go into making Notesnook better for you, not bigger for someone else.

What does this mean for existing subscribers?

If you have an active subscription (i.e. not canceled and not purchased via a gift card), you won't have to do anything. Any price change will not affect you and you can continue using everything listed in Notesnook Pro plan without interruption.

For those who are inactively subscribed i.e. canceled or by using a gift card, you will have to pay the new price in order to continue using the Pro features.

Now that we’ve talked about the why, let’s look at what’s actually changing.

The new pricing plans

We are moving away from the single-plan model and introducing three new plans:

1. Essential ($1.99/mo or $19.99/yr)
2. Pro ($6.99/mo or $69.99/yr)
3. Believer ($8.99/mo or $89.99/yr)

Note: Prices shown in USD; equivalent local prices may vary based on taxes and exchange rates. To view exact price for your country, visit our website.

You can view the full breakdown on our website, but here's a quick summary:

• Essential plan includes 1GB of storage per month, 100MB maximum file size, unlocks all editor features, in addition to a few other "essential" things.
• Pro plan includes 10GB of storage per month, 1GB maximum file size, and unlocks everything.
• Believer plan includes 25GB of storage per month and is meant for diehard fans of Notesnook ;).

Storage limit resets on the 1st of each month. You can always manage your existing uploads whenever you like.

Here's a table a user on Discord made comparing all plans:

For those who prefer long-term stability or want to invest in Notesnook’s future, we’ve also added a 5-year plan for both the Pro and Believer tiers.

What about the free plan?

The free plan

The Notesnook Basic plan has always been generous, but we are making it even better:

• You can now upload images and files (up to 50 MB per month) even on the free plan.
• Vault is now available to free users.
• All export formats are now available to free users.

Moving away from unpaid trials

Unpaid trials (aka "no credit card required trials") have been a huge source of abuse for us. It also confuses users who actually want to upgrade. To resolve all these issues, you will now be required to enter your payment information in order to enjoy a free trial.

Just to be clear, trials are still free but now you need to enter your payment method.

Notesnook for Education

We have over 5K students & teachers enjoying the Notesnook for Education discount. It's safe to say that Notesnook is a lifeline for a lot of teachers and students out there. To keep things affordable, we are now offering our Notesnook Pro plan at a fixed price of $19.99 for one year to all students and teachers.

We know many educators won’t like this change, but we believe it’s a fair adjustment that will help us keep improving Notesnook for everyone.

Regional pricing

Notesnook is still regionally priced but only for the Notesnook Pro Yearly plan. All other plans are offered at the same price to everyone around the world.

More subscription controls

Notesnook is one of the very few apps that offer single-click refunds. We are now also offering single-click plan changing with prorated pricing. You can now jump from the Essential plan to Believer plan (or any other plan) right from inside the app without contacting us.

In addition to that, we’ve also made it easier to disable auto-renew for your subscription: just a single toggle. Hopefully, this will help you stay in control and avoid any surprise charges.

FAQs

When does the price change take effect?

These price changes will take effect with v3.3 of Notesnook.

What happens if my old subscription downgrades accidentally due to payment failure?

If your payment fails or your subscription accidentally expires, we'll do our best to help you retain the same price but we make no promises. You can reach out to us via email in case something like this happens and we'll help you out.

Will my existing plan automatically move to a new one?

No. If you have an active subscription, nothing changes for you.

The future

We have huge plans for Notesnook, and many things are already under development. These include:

• Self hosting
• Third-party audit
• Inbox API (to allow sending data into Notesnook from other apps)
• Monographs v2

This is just the beginning.

Disclaimer: I am the co-founder of Notesnook, an end-to-end encrypted note taking app. I have tried to be as objective as possible but there may be some bias.

Privacy by design is far superior to privacy by promise. Companies like Google, Notion, Evernote, and in fact, any company that does not ensure end-to-end encryption all promise to never read your personal data but do nothing to actually prevent it.

Last week, I posted about this on our X account but didn't get a chance to elaborate:

Even the /r/Evernote moderators don't know this (or they don't want to acknowledge it):

In this blog post, I want to explain how Evernote always has access to your notes, why privacy policies are not guarantees, and how this can lead to user privacy violations. By the end of this blog post, hopefully you'll understand why any company claiming to protect your privacy without end-to-end encryption is just gaslighting you.

Can Evernote employees really read my notes?

In 2016, Evernote updated their privacy policy to include:

The latest update to the Privacy Policy allows some Evernote employees to exercise oversight of machine learning technologies applied to account content, subject to the limits described below, for the purposes of developing and improving the Evernote service.

This is primarily to make sure that our machine learning technologies are working correctly, in order to surface the most relevant content and features to you. While our computer systems do a pretty good job, sometimes a limited amount of human review is simply unavoidable in order to make sure everything is working exactly as it should. (emphasis ours)

A little further down they asked the question:

Who will be able to access my data?

We keep the list of Evernote employees who have access to user data as small as possible. (emphasis ours)

This was in 2016 and they quickly reverted this privacy policy update but the damage was done:

Even though this is 9 years old, it is a perfect example of a company abusing user privacy. You have to give Evernote props for listening to their users and being honest. Most companies aren't but that doesn't make the privacy situation any better. A privacy policy is just a promise, after all — it doesn't have any built-in limits to prevent the vendor from accessing your private data.

To put it simply, if I hand you a notebook for safekeeping, you'll be able to open & read it anytime. You might promise not to but I have no control over it. Even if you opened & read it, I'd have no way of knowing or preventing you.

Evernote works similarly: you give them your notes for safe keeping but there's nothing preventing them from reading those notes except a promise with conditions:

no one at Evernote can view it unless you expressly give us permission or it’s necessary to comply with our legal obligations

"If necessary to comply with our legal obligations" is a slippery slope. It basically gives a company free reign to do whatever it wants with your data under a legal pretence. But it also means the company (and in turn its employees) can open & access your notes at anytime as long as their is a legal basis.

A recent example of this is Telegram September 2024 privacy policy update which allowed them to disclose users’ IP addresses and phone numbers to law enforcement agencies internationally for any user arbitrarily. This impacted hundreds of thousands of users worldwide, users who probably started using Telegram due to its "promises", users who were caught unaware by a company's policy changes.

There is nothing wrong with complying with legal requests but all laws are not equally good. Governments change, policies shift, the legal becomes illegal, something you wrote or said years ago could be used against you today, and in it all, you remain powerless because your data is not in your control.

In contrast, if you look at end-to-end encrypted systems, your data is encrypted before you give it over to the vendor much like locking away your notebook in a secure box before giving it to a friend for safe keeping. Even if your friend wanted to, he'd have no way to open the box to see what's inside. Zero compromise. Complete control.

How far can you trust privacy policies?

In 2024, LinkedIn was caught abusing users' data for training AI without their consent even though their privacy policy had no mention of this. A survey conducted in 2019 in America concluded that 78% people almost never read privacy policies, and those that do, just glance over it.

How can you trust in a promise that you don't even read?

Technically speaking, if a company violated their privacy policy the users wouldn't know about it until after the damage was done. For example, if Evernote secretly trained an ML model on your notes, there would be zero public proof to hold against them. This has happened countless times where privacy policy updates were made only after users' privacy had been violated:

• In 2010, Google launched their social media platform, Google Buzz, and automatically enrolled all Gmail users making their contact data publicly visible—without user consent or a prior privacy policy update.
• In 2013, Path made a settlement with FTC for violating users' privacy by secretly uploading their mobile address books.
• In 2017, Vizio embedded tracking software in its smart TVs that monitored user viewing habits and device metadata (e.g. Wi-Fi networks and demographic segments) and transmitted this to third parties—despite general privacy policy statements that did not clearly disclose these intrusive practices.

There are countless examples like these where the company said one thing in its privacy policy but did the complete opposite. Privacy policies are just that: policies. We, as users, trust the companies will keep their word but there are no built-in limits to prevent them from not doing that.

At the end, the choice is yours: do you want privacy by promise or privacy by design?

End-to-end encryption requires no trust

In end-to-end encryption, you own the keys, the door, and the house. You decide who enters — not some company policy that can change without notice. The new Evernote privacy policy mentions:

To help refine or improve the technology, we may ask you for permission to review portions of your Content.

How is this "permission" acquired? A toggle in the app? What does the toggle actually do? Does it hold the key to your data? No. Does it have control over who can access your data? No. It just updates a value in a database that has nothing to do with your data. What happens if your personal notes get "reviewed" without your permission by mistake? This is what end-to-end encryption was designed to prevent.

"Encrypting everything is just not realistic"

A lot of companies run away from end-to-end encryption because it's hard. It's hard to do everything on users' devices. It's hard to make things cross-platform. It's hard to make a good search. It's hard to keep everything performant.

It's hard but not impossible.

If you go through Evernote's transparency reports, you will notice multiple instances where Evernote responded to requests with user data. They do not mention whether that includes user notes but they are legally bound to respond to such requests with as much data as they can within the limits of the law.

The question is: why do they have the power to "provide" your data, with or without your consent, to anyone? Shouldn't you be in control of who gets to access your data? Is it even your data if you have no control over who can read, access, and monitor it?

Evernote is not alone in this. All companies that do not end-to-end encrypt user data have to hand over your private data if pressured under the law. They have no choice in the matter. By giving them power to host your data, you also give them the control to share whatever they want with whoever they want.

What about companies that end-to-end encrypt everything? Aren't they also legally required to respond? They are but everything is encrypted so there's not much anyone can do even if they have the raw encrypted blobs.

"It's just notes"

Why do you put a lock on your phone? Isn't it "just a phone"? Why not let everyone access everything in it freely? Because it's private, it's personal, and it doesn't matter what you have in there — what matters is that it's yours.

Caring about privacy does not make you a criminal — it just makes you human.

Conclusion

Don't depend on privacy policies to protect your privacy. Unless your data is encrypted before it leaves your device, someone, somewhere, always has the keys and the access. If this concerns you (as it should) and you want to take back control over your data then here are a few resources you can look into:

• Privacy Guides - the best way to start taking back control over your digital life. Includes recommendations for alternatives to non-private tools like browsers, operating systems, email clients, note taking apps etc. Their community is absolutely awesome and will help you start your privacy journey. I recommend checking out their Why Privacy Matters article.
• Techlore - a wonderful resource of videos, articles, tools, alternatives to help you get started with privacy.

There are many other resources you can follow, as long as you keep one thing in mind: your privacy matters.

New search experience

Search has always been horrible in Notesnook. Well, that is changing now. In this release, we have made massive improvements to the way search works, including:

1. Token by token search highlighting.
2. Improved relevance based sorting.
3. Sort search results by title, date edited etc.
4. Jump directly to a specific search result within a note.
5. No more false positives.

Archive

I know, I know, this is pretty basic and it shouldn't have taken us this long but here we are. Archive. Finally. It works exactly how you'd expect it to: notes that you archive will only be visible and searchable from within the archive.

Integrated Importer

We are moving the Importer directly into the web/desktop app making for a much better migration experience. No more back and forth between multiple pages. Just drag/drop your Evernote (or some other notes app) archive and it'll directly be imported into the app.

You can read our guide on how to how to use the new importer.

Set any tag as default

You can now set any specific tag as default and it will be applied automatically for all new notes (works just like default notebook). Just right click (or long press on mobile) on a tag and select "Set as default".

Fixes and minor improvements

As with all our releases, we've fixed a bunch of bugs and improved the overall user experience. Thanks to our beta users you'll find this release much more stable and performant.

Read the full commit history here.

New sidebar UI

A lot of users have been frustrated with the way notebooks and tags functioned making it cumbersome to organize & find notes. While we could just slap a tree view on top of the existing UI, move everything into the sidebar and call it a day. We did not want to clutter the sidebar by moving everything into a flat list top-to-bottom. That would make finding things even harder even though it'd be more familiar.

Moving notebooks & tags into their dedicated tabs makes many things simpler. For example, you can now easily filter notebooks or tags without having to scroll through a long list. Additionally, the tree view for notebooks allows you to quickly navigate through your notes in one place.

Tree view for notebooks

With a dedicated tree view for notebooks, we aim to solve 2 things:

1. Seamless navigation: The tree view allows you to quickly navigate through your notebooks and their contents without any back & forth.
2. Effortless organization: Organizing notes is just a simple drag-and-drop operation.

Set any notebook, tag or color as homepage

Previously, you could only set the homepage to the notebooks, tags or other pages. Now, you can set the homepage to any specific tag, color, or notebook. Just right click (or long press on mobile) and select "Set as homepage".

Fixes and minor improvements

As with all our releases, we've fixed a bunch of bugs and improved the overall user experience. Thanks to our beta users you'll find this release much more stable and performant.

Read the full commit history here.

Previous releases:

• v3.0.27 fixes 10+ bugs via 53 commits. Command palette, quick open, paste as markdown, wrapped multiline title in web/desktop app, and more!
• v3.0.26 fixes 10+ bugs via 39 commits. Fixed 2 security vulnerabilities, new keyboard shortcuts for tabs, and more!
• v3.0.25 fixes 10+ bugs via 88 commits. Improved tabs with history, navigation & other goodies!

Notesnook Beta Release Track

We are excited to introduce the Notesnook Beta release track. This track will allow you to try out the latest features and improvements before they are released to the stable version. You can switch to the Beta release track by going to the Settings > About and switching to the Beta release track.

Note: you can switch back to the stable release track at any time without losing any data.

If you like to live at the edge, we'd appreciate if you can join the beta and help test out new features and improvements. Your feedback will help us make Notesnook even better!

Add keyboard shortcut for opening settings

Press Ctrl + , (Windows/Linux) or Cmd + , (Mac) to open the settings dialog.

by @01zulfi in #7701

Fixes and minor improvements

1. Adjust toast position by @01zulfi in #7665
2. Open internal links in new tab using middle mouse click by @01zulfi in #7688
3. Fix tags and notebooks search
4. Fix single & double spaced paragraph margins in editor & callouts
5. Fix gap between title and editor on entering focus mode

Read the full commit history here.

Previous releases:

• v3.0.26 fixes 10+ bugs via 39 commits. Fixed 2 security vulnerabilities, new keyboard shortcuts for tabs, and more!
• v3.0.25 fixes 10+ bugs via 88 commits. Improved tabs with history, navigation & other goodies!
• v3.0.24 fixes 20+ bugs via 65 commits. Better integrated titlebar, reminders & note widgets on iOS/Android, and more!

Note: On the mobile app, the version containing these fixes & improvements should be v3.0.33.

Command palette

Introducing the command palette, a powerful tool that allows you to quickly access and execute various actions within Notesnook. With just a few keystrokes, you can perform tasks such as creating new notes, notebooks, navigating, and managing your tags.

Just press Ctrl + k (Windows/Linux) or Cmd + k (Mac) to open the command palette, and start executing away.

by @01zulfi in #7314

Quick open

In addition to the command palette, you can also use the quick open feature to quickly access your notes, notebooks, tags & reminders. Just press Ctrl + p (Windows/Linux) or Cmd + p (Mac) to access the quick open dialog.

by @01zulfi in #7314

Paste as markdown

This is one of the most requested features, especially by users who prefer Markdown over Rich Text. Notesnook has always supported Markdown shortcuts but now it also supports pasting Markdown content directly into notes.

Whenever you paste something into the editor, Notesnook will automatically detect if it's Markdown (based on some heuristics) and convert it to rich text. If you don't want this behavior, you can use Ctrl+Shift+V (Windows/Linux) or Cmd+Option+Shift+V (Mac) to paste as plain text.

by @thecodrr in #7608

Wrapped titles in web/desktop app

The mobile version of Notesnook has always had wrapping for titles but now it's also available in the web/desktop app.

by @01zulfi in #7290

Fixes and minor improvements

1. Fix status bar disappearing on small/tablet-sized screens by @luis-411 in #7542
2. Fix note title sync if note is opened in multiple tabs by @01zulfi in #7636
3. Fix submenu positioning by @01zulfi in #7632
4. Fix tags can not be added/removed from the editor by @01zulfi in #7623
5. Add scroll margin & threshold in editor to improve scrolling with arrow keys experience by @01zulfi in #7292
6. Improve hr & p spacing in editor by @01zulfi in #7489
7. Fix pinned tabs allowing new notes to be opened in the same tab by @thecodrr and @ammarahm-ed in #7457
8. Fix search in complex elements like tables, lists etc. by @Waqar144 in #7605
9. Fix youtube embeds rendering as black blocks by @thecodrr in #7608

Read the full commit history here.

Previous releases:

• v3.0.25 fixes 10+ bugs via 88 commits. Improved tabs with history, navigation & other goodies!
• v3.0.24 fixes 20+ bugs via 65 commits. Better integrated titlebar, reminders & note widgets on iOS/Android, and more!
• v3.0.23 fixes 30+ bugs via 99 commits. Gift cards, search results sorted by date created, improved UX when auto save is disabled, and more.

Note: On the mobile app, the version containing these fixes & improvements should be v3.0.32.

Fix 2 potential XSSs when pasting untrusted content into the editor

1. Potential XSS when pasting/inserting an iframe containing a javascript link.
2. Potential XSS when pasting/inserting an svg containing JavaScript (why do SVGs allow JS in the first place?).

Mitigations include disallowing all execution of JS inside an SVG by rendering it in a sandboxed iframe. While we cannot disallow JS execution in embeds (that would break all embeds like YouTube videos), we have disallowed access to the parent window to all iframes, again, by using a sandboxed iframe and by disallowing embedding of javascript: links.

These vulnerabilities affect the following apps:

1. Web app - medium risk
2. Mobile app - low risk since the editor runs in its own process completely isolated from the Notesnook app
3. Desktop app - medium risk

These vulnerabilities cannot be used to steal or access your notes or any other data since everything is stored and accessed from an encrypted SQLite database which isn't globally accessible by any script. Your data would be 100% safe and isolated from such an attack. However, an attacker could still cause havoc and track your activities while using the app so it's recommended that you upgrade to v3.0.26 as soon as possible.

We are not aware of any instance where this vulnerability was exploited in the wild. It is still recommended that you double check before pasting things from untrusted parts of the web.

Special thanks to @sksec_ for responsibly reporting these vulnerabilities.

Keyboard shortcuts for tabs

Yep, we are finally working on making Notesnook keyboard accessible. Better late than never, right? Anyway, we have added the following new keyboard shortcuts:

• Ctrl/Cmd+t to open new tab.
• Ctrl/Cmd+n to create a new note.
• Ctrl/Cmd+w to close the active tab.
• Ctrl/Cmd+Shift+W to close all tabs.

Some of these shortcuts might not work in the web app due to browsers disallowing overriding those shortcuts. In such cases, you can press an extra Shift key to trigger the shortcut. For example, instead of Ctrl/cmd+t to open a new tab, you can press Ctrl/cmd+Shift+T.

by @01zulfi in #7109

Select programming language by pressing Enter key

You can now directly press the Enter key to select the topmost language when changing the programming language of a code block. Pressing the Escape key will now also close the language selector popup.

by @KYash03 in #7484

Fix search queries containing special characters

Special characters are recognized as column names by SQLite and need to be properly escaped if they are to be searched.

by @luis-411 in #7418

Device specific settings are no longer reset on logout

Previously, we were clearing everything in the local stores on logout which also cleared things like the current selected theme, font sizes etc. In this release, all device specific settings are ignored when logging out.

by @ammarahm-ed in #7423 and @01zulfi in #7436

Fixes and minor improvements

1. Fix status bar disappearing on small/tablet-sized screens by @luis-411 in #7542
2. Hide undo & redo buttons for readonly notes by @01zulfi in #7541
3. Fix app icon appearing corrupt in some places on macOS by @xa4hf8 in #7542
4. Fix various typos in code comments and other places by @luzpaz in #7463
5. Fix subnotebook title not updating on navigate by @luis-411 in #7286
6. Fix task list stats appearing as 0/0 on app reload by @luis-411 in #7327
7. Fix collapsed pane expanding on app reload by @thecodrr in #7449
8. Fix crash on app launch with new tabs by @ammarahm-ed in #7451
9. Show progress when taking backup and allow to hide backup dialog by @ammarahm-ed in #7452
10. Fix opening note from widget opens incorrect note by @ammarahm-ed in #7453
11. Fix unlocking note with biometrics by @ammarahm-ed in #7459
12. Fix file size is 0 errors when downloading attachments by @ammarahm-ed in #7458
13. Fix dialog calling onClose after pressing positive button by @ammarahm-ed in #7558

Read the full commit history here.

Previous releases:

• v3.0.24 fixes 20+ bugs via 65 commits. Better integrated titlebar, reminders & note widgets on iOS/Android, and more!
• v3.0.23 fixes 30+ bugs via 99 commits. Gift cards, search results sorted by date created, improved UX when auto save is disabled, and more.
• v3.0.20 fixes 40+ bugs via 167 commits. Faster app startup, improved ToC, more accurate search, zoom in editor, and faster checkout.

New and improved tabs

We have overhauled the whole logic behind tabs in this release. Here are some of the improvements:

1. Tab history: You can now go back and forth in the tab history using the back and forward buttons in the tab bar.
2. No more preview tabs: We have removed the preview tabs feature. Now, when you open a note, it will open in the same tab unless you right click and open it in a new tab explicitly.
3. Open a note in multiple tabs: You can now open a single note in multiple tabs (a precursor to side-by-side note editing). Changes in one tab will automatically sync to all other tabs.

These changes will significantly improve the tab experience in Notesnook. You'll no longer have a 100 tabs open when you're just trying to find that one note. 🎉

/nowz and /timestampz editor shortcuts

We have added two new editor shortcuts to make your life easier:

1. /nowz: This will insert the current date and time in the editor alongwith the timezone.
2. /timestampz: This will insert the current timestamp in the editor alongwith the timezone.

by @01zulfi in #7109

Fixes and minor improvements

1. Fix sidebar collapsing when resizing the window by @luis-411 in #7377
2. Fix hover styling in toolbar color buttons by @01zulfi in #7421
3. Fix various android widget bugs by @ammarahm-ed in #7416
4. Fix attaching a file in new note editor by @ammarahm-ed in #7422
5. Close sheet on backup completed by @ammarahm-ed in #7424
6. Fix release notes rendering by @ammarahm-ed in #7435
7. Fix object is not iterable error by @thecodrr in #7433
8. Fix empty notes not included in exports by @thecodrr in #7433
9. Fix search not resetting when closed by @01zulfi in #7415
10. Show toast when changing some settings on mobile by @ammarahm-ed in #7376
11. Add a link popup now has proper labels for fields by @luis-411 in #7097

Read the full commit history here.

Previous releases:

• v3.0.23 fixes 30+ bugs via 99 commits. Gift cards, search results sorted by date created, improved UX when auto save is disabled, and more.
• v3.0.20 fixes 40+ bugs via 167 commits. Faster app startup, improved ToC, more accurate search, zoom in editor, and faster checkout.
• v3.0.18 fixes 40+ bugs via 131 commits. Improved search query handling, support for configuring server urls from login screen, importing nested notebooks/folders from other apps, and more.

Better integrated titlebar on Desktop

The app UI now integrates better with the titlebar taking much less space and looking more native. This change also unifies the titlebar across web & desktop apps allowing for better themability.

New widgets on Android/iOS

1. Reminders widget: You can now see your reminders on the home screen. This widget will show you all your active reminders, and also allow you to add a new reminder.
2. Note widget: Pin specific notes to your home screen. This widget will show you the pinned note's title and a preview of the content.

Lock app button in status bar

If you have app lock enabled, you can now quickly lock the app from the status bar.

by @01zulfi in #7333

Markdown shortcut for adding checklist

You can now add a checklist by typing - [ ]. Typing - will create a bullet list as usual and if you type [ ] in the bullet list, it'll automatically convert the bullet list into a checklist.

by @01zulfi in #7087

Keyboard shortcuts for next/previous tab

• Ctrl/Cmd + Alt/Option + Left Arrow to go to the previous tab
• Ctrl/Cmd + Alt/Option + Right Arrow to go to the next tab

by @01zulfi in #7109

Save image compression upload setting

You can now disable the "Image compression" dialog shown whenever you paste/drop an image in the editor from Settings > Behavior. This setting includes the following options:

• Enable
• Disable
• Ask me every time (default)

by @01zulfi in #7089

Fixes and minor improvements

1. Fix casing in legal & notebooks strings by @01zulfi in #7142
2. Fix status bar size changing by @01zulfi in #7143
3. Fix vault unlock status not shown when a note was unlocked by @01zulfi in #7172
4. Replace react-resizable-panels with custom implementation by @thecodrr in #6829
5. Fix scroll jumping in realtime sync by @ammarahm-ed in #7247
6. Fix image file upload by @ammarahm-ed in #7246
7. Fix trash interval picker text showing NaN by @ammarahm-ed in #7319
8. Fix edit profile name dialog by @01zulfi in #7338
9. Fix referencedIn casing by @01zulfi in #7334
10. Render setting item descriptions as markdown by @01zulfi in #7343
11. Fix follow casing by @01zulfi in #7342
12. Fix DATE_TIME_STRIP_REGEX by @ammarahm-ed in #7325
13. Fix clamped image size is larger than editor's width by @ammarahm-ed in #7324
14. Fix selecting image from gallery when applock is on by @ammarahm-ed in #7332
15. Fix material menu by @ammarahm-ed in #7331
16. Fix image previews not loading on ios by @ammarahm-ed in #7323
17. Always load note content in editor by @ammarahm-ed in #7320
18. Fix search strings by @luis-411 in #7302
19. Fix reveal in list by @01zulfi in #7297

Read the full commit history here.

Previous releases:

• v3.0.20 fixes 40+ bugs via 167 commits. Faster app startup, improved ToC, more accurate search, zoom in editor, and faster checkout.
• v3.0.18 fixes 40+ bugs via 131 commits. Improved search query handling, support for configuring server urls from login screen, importing nested notebooks/folders from other apps, and more.
• v3.0.17 fixes 4 bugs via 11 commits. Fixed zero notebooks after adding 20+ notebooks on a Basic account, fixed multiple updates running simultaneously in desktop app, and fixed tags not assigned to web clips.

Search results sorted by date created

Search results are now sorted by date created instead of relevance which was, to be frank, absolutely horrible. This change should make search results much more useful until we add support for sorting by other fields.

Gift cards

You can now buy Notesnook Pro gift cards for your friends and family so they can enjoy better privacy too! Learn more about this in the blog post.

Improved UX when auto save is disabled

By default, Notesnook disables auto saving when the note size exceeds 100K words but until now, there was almost no indication that auto save was disabled. Now, we have added multiple fail safes to prevent accidental data loss when auto save is disabled including:

1. A warning prompt when auto save is disabled.
2. Saving the note automatically if its closed.
3. Saving the note automatically if the app moves to background.
4. Saving the note automatically when switching between notes.

This will ensure that you never lose your data even if auto save is disabled.

@01zulfi in #6818

Fixes and minor improvements

1. Fix attachment downloading on mobile by @ammarahm-ed in #6971
2. Always show desktop backup directory path (#6867) by @01zulfi in #6953
3. Fix inconsistent zoom amount when adjusting with scroll wheel by @Leviob in #6990
4. Fix zoom value showing value upto 9 decimal points by @01zulfi in #7009
5. Hide spin buttons in mfa code input which were overlapping with other buttons by @01zulfi in #7048
6. Disable spellcheck for inline code by @01zulfi in #7036
7. Hide edit button when in read only mode by @luis-411 in #7018
8. Fix ObjectId length is sometimes less than 24 characters by @dyw770 in #6994
9. Handle errors in parseInternalLink by @01zulfi in #7065
10. Fix tags not showing in locked note by @01zulfi in #7061
11. Fix links in report issue dialog by @01zulfi in #7071
12. Prevent creation of multiple empty notes by @luis-411 in #6922
13. Make link color align with theme by @luis-411 in #7077
14. Show account password label in delete vault dialog by @01zulfi in #7085
15. Fix editor toolbar scroll styling by @01zulfi @thecodrr in #7113
16. Fix mfa fallback string by @01zulfi in #7123
17. Fix various localization issues & crashes by @ammarahm-ed in #7008
18. Fix snooze time not rendered properly by @ammarahm-ed in #7080
19. Fix sharing files on Android by @ammarahm-ed in #7082
20. Fix custom proxy URL cannot be reset on mobile by @ammarahm-ed in #7094
21. Fix undo/redo buttons in editor by @ammarahm-ed in #7122
22. Fix task list stats not showing on opening a note by @01zulfi in #7117
23. Disable pasting in task list when readonly mode is enabled by @01zulfi in #7117
24. Fix multiple file sharing on android by @ammarahm-ed in #7138
25. Fix password hashing on iOS by @ammarahm-ed in #7093

Thank you to @01zulfi, @luis-411, @dyw770 and all other contributors for making this release possible!

Read the full commit history here.

What are Notesnook Gift Cards?

Gift cards are a great way to introduce your friends and family to Notesnook without them having to worry about the cost. You can gift them a subscription plan of their choice and they can start using Notesnook without any hassle. It's a great way to show them that you care about their privacy and security.

Gift cards are non-renewable and can be used only once. They are available in 1 year, 3 year, and 5 year plans. You can purchase them from our website and send them to your friends and family. They can redeem the gift code in our app and start using Notesnook Pro right away.

Can I use the gift card to extend my subscription?

This is currently not possible. Gift cards are meant to be gifted to others. If you want to purchase a subscription for yourself, you can do so from our app.

Is there an expiry date for the gift cards?

Yes, gift cards expire after 1 year of purchase. Make sure to redeem the gift card before it expires.

How do I redeem the gift card?

We have a detailed guide on how to redeem the gift card in our app. You can find it here.

Free gift card giveaway

To celebrate the launch of gift cards, we are giving away 10 free 1 year gift cards to our users. You don't have to do anything to participate. We will randomly select 10 users and send them a gift card.

We are also giving away free 1 year gift cards to all our active Pro subscribers. If you have an active Notesnook Pro subscription, you should be receiving an email from us soon with the gift card code.

Upto 60% off on all gift cards

We are also offering a special discount on gift cards for a limited time. You can get upto 60% off on 1 year, 3 year, and 5 year gift cards. This is a limited time offer valid until January 2nd, 2025.

Get your gift card now!

Previous releases:

• v3.0.18 fixes 40+ bugs via 131 commits. Improved search query handling, support for configuring server urls from login screen, importing nested notebooks/folders from other apps, and more.
• v3.0.17 fixes 4 bugs via 11 commits. Fixed zero notebooks after adding 20+ notebooks on a Basic account, fixed multiple updates running simultaneously in desktop app, and fixed tags not assigned to web clips.

Search improvements

In v3.0.18, we introduced a new search query transformer but it treated everything as a phrase by default i.e. hello world would only return notes that contain hello world and not hello or world or both. This was not the expected behavior and was causing a lot of confusion. This has been fixed now.

Secondly, we fixed search queries less than 3 characters returning no results in v3.0.17 but it lacked any kind of ranking or sorting. In this release, we have included a custom SQLite FTS5 tokenizer that tokenizes 1 and 2 character words separately making them easier to search. This also fixes issues where queries like top of the world would return nothing because of is less than 3 characters in length.

While we haven't tested this new tokenizer with CJK languages, it should work much better.

Faster app startup

Web app startup has been improved by almost 5x from 3500ms to 700ms excluding network latency. This is a huge improvement and should make the app feel much snappier.

We removed 6-8 dependencies and replaced them with custom alternative that does the same thing in a more lightweight way. This has also reduced the app size by a few hundred kB.

ToC improvements

Table of Contents (ToC) no longer covers note content and also preserves its open/closed state across app sessions. The ToC pane is now also resizable.

@01zulfi in #6818

Add support for configuring Monograph server URL

You can now configure the app to use a custom Monograph URL instead of monogr.ph.

Zoom in Editor

You can now zoom in the editor using Ctrl/Cmd + mouse wheel. This is especially useful for users with accessibility issues.

@01zulfi in #6846

Vault unlocked indicator in status bar

The status bar now shows if the vault is unlocked (clicking on the status bar button will lock it again) ensuring you don't accidentally leave the vault unlocked.

@01zulfi in #6830

Fixes

1. Fixed note title not focusing until clicked twice on Chrome (#6767) by @01zulfi in #6817
2. Fixed restore notebooks over limit for free users (#6812) by @01zulfi in #6837
3. Fixed attachment preview logic (#6822) by @01zulfi in #6843
4. Fixed copy link button copying link text instead of link (#6642) by @01zulfi in #6845
5. Fixed markdown link pasting (#6639) by @01zulfi in #6866
6. Fixed backspace deleting formatting in list item by @01zulfi in #6878
7. Fixed duplicate window controls showing on Linux desktop app by @alihamuh in #6844
8. Added confirm password check when changing app lock password by @alihamuh in #6808
9. Fixed right side panel of settings is not scrollable on Chrome by @alihamuh in #6716

Other changes

This release took a lot of time to get ready due to the massive changes required for localization. The app is now fully tranlatable i.e. once we setup a translation platform, we can start onboarding contributors to help translate the apps. Aside from that, here's a short list of changes that didn't make it to the main list:

1. Upgraded Electron to v31 (we stay a little behind to avoid any unintended issues).
2. Added tests for the desktop app on all platforms
3. Added benchmarks to ensure app startup remains fast

Read the full commit history here.

Previous releases:

• v3.0.17 fixes 4 bugs via 11 commits. Fixed zero notebooks after adding 20+ notebooks on a Basic account, fixed multiple updates running simultaneously in desktop app, and fixed tags not assigned to web clips.
• v3.0.15 & v3.0.16 fix a critical bug causing errors on sync & other actions.
• v3.0.14 fixes 30 bugs via 124 commits. Added full offline mode, backups with attachments included, ability to change server URLs (self hosting yay!), and fixed a lot of bugs.

Improved search query handling

Notesnook now has a query transformer that converts your query into something that SQLite FTS5 can easily parse. This means searches should now be massively improved across the board:

1. Search query are now AND by default instead of OR

Previously, if you searched for hello world, it would return notes that contain either hello or world. Now, it will only return notes that contain both hello and world. This is the expected behavior on almost every search engine allowing you to narrow down search results as you type instead of widening them.

2. Use capitalized AND/OR/NOT for more complex searches

For example, you can search for hello world NOT hello earth to find notes that contain hello world but not hello earth. Similarly, if you want to find notes that contain either hello world or hello earth, you can search for hello world OR hello earth.

3. Diacritics are now ignored when searching

Diacritics are accents or marks added to letters. For example, é in café. Previously, if you searched for cafe, it wouldn't return notes that contain café. Now, it will return notes that contain either cafe or café. Cool, right?

Add support for configuring server URLs from login screen

You can now configure the app to use your own server URLs right from the login/signup screen.

The login screen also informs you about which instance you are using (the official one or your own). This is so you can avoid accidentally creating an account on the wrong instance.

Add support for importing nested notebooks/folders from other apps

You can now migrate into Notesnook while preserving 100% of your notes organization. This includes when you are importing markdown or text files in nested folders.

Add delete key shortcut for deleting items

If you have selected multiple items (notes, tags etc.) you can quickly delete them by pressing the delete key. Easy peasy.

Add ctrl+k shortcut for inserting a new link

One of the most highly requested keyboard shortcuts, you can now press Ctrl/Cmd + k to open the Insert link popup. This works automatically when you have some text selected and want to insert a link into it.

Add new dot separated (e.g. DD.MM.YYYY) date formats

We have added a couple of new dot separated date formats like DD.MM.YYYY. These formats are used in various parts of the world (Russia, China etc.). To change the date format, go into Settings > Behaviour.

Delete app data on uninstall (Windows only)

When you uninstall the desktop app on Windows, it will now delete all app data. This includes your notes, settings, and other data. This is to ensure that your data is not left behind on your computer.

This only works on Windows which supports uninstall hooks.

Fix custom server URLs having no effect in production

We enabled self hosting and ability to change server URLs in v3.0.17 but, accidentally, forgot to enable it in production. This has been fixed now.

Do not zip note without attachments on export

Exporting a note that has no attachments will no longer create a ZIP archive of a single file. Hopefully, this will improve many users' workflows.

Fix attachment downloads stuck on error

The app will now automatically skip over any errors that occur during bulk downloads of attachments. The errors will still be logged and shown on the screen but instead of getting stuck, the download process will continue downloading the next file.

Add integrity checks in various places for attachments

We have added integrity checks in various places like encryption, uploading to proactively detect corrupted uploads so you can take action. These checks mainly verify the file size before and after encryption & upload to make sure there aren't any missing chunks.

Show progress when rechecking attachments in bulk

While it was possible to recheck attachments in bulk, there was no progress indicator. This has been fixed now. You'll see the progress in the status bar while the rechecks are taking place in the background.

Fix note title can be set to empty

As much as we'd like to support untitled notes, titles are a fundamental part of Notesnook and are used in various critical places. This bug accidentally enabled untitled notes which caused issues like empty filenames on export & publishing. This has been fixed now and affected notes should automatically get a new title when you update them.

Fix invalid filename when saving recovery key

When you save your recovery key, the app creates a file named using your email address for easier identification. Due to this bug, the file was getting saved as [Object]-key.txt instead of example@notesnook.com-key.txt. This has been fixed now.

Fix Error in input stream crash in web/desktop app

This usually occurred after waking your PC/laptop from sleep while the app was running, or when after recovering from an Internet connection disruption. The error itself is harmless but it was causing the app to crash and display the "Something went wrong" screen.

Exit a link inside the editor by pressing space

A massive QoL improvement for link junkies. If you insert a lot of links, it's extremely annoying when after inserting a link everything after it also becomes part of the link text. It was almost impossible to exit the link. We have fixed that in this release!

Just press the Space key and it'll automatically exit the link and you can continue typing without breaking a sweat.

Press Enter in link popup to insert link

Another QoL improvement. This was such a basic expectation that I was almost embarrassed that someone created an issue for it. But, it's fixed now. You can press Enter to insert the link instead of clicking the Insert button.

Fix found 0 byte sized chunk error on attaching files in Firefox

We use OPFS (Origin Private File System) for caching attachments in the browser which supports synchronous and very fast file system reads & writes. As expected, all browsers don't work the same way though. On Chromium based browsers, it is okay to hold a read-only handle to a file and write to it at the same time. Not so much on Firefox.

The underlying error looked something like this: No modification allowed which meant, in order words, that we didn't have the permission to write or read to the file.

In v3.0.17 I added a fast path for getting file sizes used for integrity checks. The code looked something like this:

async function readFileSize(
  directory: FileSystemDirectoryHandle,
  name: string
) {
  const file = await directory.getFileHandle(name);
  const handle = await file.createSyncAccessHandle({ mode: 'read-only' });
  return handle.getSize();
}

Notice anything wrong? I wasn't closing the handle after reading the file size. Oops! The fix was simple:

const size = handle.getSize();
handle.close();
return size;

Tested on Firefox and it worked! 🎉

Fix error when downloading the same attachment on mobile

The error looked something like this: Error: “3289114832a786d7_temp” couldn't be moved to “.cache” because an item with the same name already exists. Apparently, the app wasn't overwriting the downloaded attachment causing the error. This has been fixed now.

Fix cannot jump to headings from TOC after copy pasting content

Table of Contents in Notesnook works based on data-block-id in each heading. This block-id is randomly generated for every node (except a few). However, not when it already exists which was the case when you copy pasted the same heading multiple times inside the note. When you tried to jump to the newly pasted headings, it would take you directly to the first one because the data-block-id for all headings was the same.

This has been fixed now. The editor automatically removes and regenerates the block-id for each node when you paste anything.

Fix Cannot destructure property 'type' of 'e[0]' as it is undefined. crash when searching

This was occurring because we weren't filtering out search results that had no note against them. This has been fixed now.

Fix issues with code block toggling

Thanks to @seanwynwins for fixing this in #6435.

Fix locking notes with empty content causing weird behavior

When you tried to lock an empty note, it'd leave the whole note in an awkward state where the note said, "I am locked" but since it had no content, the app said "You are not locked". The problem worsened when you tried to get out of this state because now you couldn't unlock the note. Well done.

This was fixed by creating a dummy content (out of thin air) when you try to lock an empty note.

Fix text rendering in bug report confirmation dialog

Thanks to @Parthiv-M for fixing this in #6573.

Fix app crash after phone reboot on Android 14

This was caused because of the new changes made by Google in Android 14 that requires all apps that use Foreground Services to declare it in the manifest. Otherwise, the app would just crash.

Fix app crash when app removed from Recents

This was caused because we were using MMKV for storing session data (i.e. which note you have opened) when you minimized the app. Initializing MMKV in the background was not super reliable so we have moved to using something more "native" for stuff like this.

Note: This fix was released in v3.0.17.

Improved attachments manager on mobile app

The attachments manager now opens in full screen instead of in a small sheet at the bottom. We have also added a new "Errors" filter to quickly see attachments that have errors. The attachment manager also now shows in progress downloads at the top in a nice UI (especially useful when you turn on full offline mode and your attachments are downloading).

Improved toast notifications UI on mobile

The toast UI notifications has been improved (thanks to @ammarahm-ed) and all toasts are now shown on the bottom for better reachability.

Other changes

This release fixes a lot of long standing issues with the app. Here are some of the other changes:

1. Upgraded Electron to v30 (we stay a little behind to avoid any unintended issues).
2. Lots of under the hood refactoring and improvements.
3. Fixed status bar flicker on app launch on Android
4. Fixed markdown shortcuts toggle resetting on app launch

Read the full commit history here.

Previous releases:

• v3.0.15 & v3.0.16 fix a critical bug causing errors on sync & other actions.
• v3.0.14 fixes 30 bugs via 124 commits. Added full offline mode, backups with attachments included, ability to change server URLs (self hosting yay!), and fixed a lot of bugs.
• v3.0.13 fixes 7 bugs via 8 commits. Fixed attachments flicker in note properties, pressing Enter in title now focuses the editor, and fixed crash on moving tabs.

Fixed zero notebooks after adding 20+ notebooks on a Basic account

This was a bug introduced in v3.0.14. If you added more than 20 notebooks on a Basic account, all the notebooks would disappear.

Fixed tags not assigned to web clips

Tags were not being assigned to web clips due to the changes introduced in v3. The web clipper was sending the tags as-is instead of their ids causing the app to skip them. This has been fixed now.

Fixed search queries less than 3 characters returned no results

Ever since migrating to SQLite in v3, search queries less than 3 characters returned no results. This was due to a limitation in SQLite's FTS5 implementation. We have now added a workaround to allow searching for queries less than 3 characters.

Unfortunately, this workaround is not perfect and the results are not sorted but it is better than returning nothing.

Read the full commit history here.

Previous releases:

• v3.0.13 fixes 7 bugs via 8 commits. Fixed attachments flicker in note properties, pressing Enter in title now focuses the editor, and fixed crash on moving tabs.
• v3.0.12 fixes 9 bugs via 16 commits. Faster attachment downloads, update availability indicator fixed on desktop app, and added support for clearing attachment cache.
• v3.0.11 fixes 10 bugs via 24 commits. Editor session data is now stored encrypted by default, fixed various editor related issues especially with pasting content, and other performance optimizations.

Okay, lots of things to unpack here. This was almost going to be v3.1.0 release but we are saving that for something a little more "fancy".

Full offline mode

Notesnook has always had "offline" mode in one way or another, but starting from v3.0.14, you can opt-in to downloading all your attachments upfront as opposed to on-demand. What's the difference, you ask?

• On-demand: Attachments are downloaded when you open a note that has them. This is the default behavior and is good for saving bandwidth and storage.
• Full offline: Attachments are downloaded on sync (and when you open the app) and are always available offline. This is good for when you often need to access your data without an Internet connection.

Should you enable full offline mode on all your devices? We don't recommend this as it can quickly fill up your storage. Use it only on devices where you absolutely have to have all your data offline. If, however, you decide to enable it on all your devices, you can take advantage of the new "Backups with Attachments" feature to save up on bandwidth costs.

Backups with attachments

This is a feature that has been requested by a lot of users. You can now create "full" backups including all your attachments. This also automatically enables the "full offline mode".

The minimum automatic interval for these backups is "Weekly" compared to "Daily" for normal backups. You can take as many full backups as you want manually, though.

The main reason for adding this feature was, of course, self hosting.

Self hosting

Starting from v3.0.14, you can change server URLs from Settings > Server. Self hosting is not stable yet so expect a lot of things not to work when connected to your own instance of Notesnook. However, we still included this change to allow people to easily early test this.

Faster sync on app startup

This was reported by a user on Reddit (even though I noticed this many times as well). The delay in first sync was caused by the app waiting on a lot of unnecessary things to finish before starting the sync.

Something you'll immediately notice in this release is that sync runs instantly on opening the app. We have also removed unncessary checks causing significant slowdown on each sync so you'll have a much smoother overall experience now.

Purge all opt-in telemetry related code

We moved from opt-out telemetry to opt-in telemetry last year and it turned to be just as useless as expected. Very few people opted in and the data was next to useless, so we have decided to just get rid of this abomination. It doesn't belong in a privacy-first app anyway.

No telemetry. No analytics. We are 100% blind on the client side. Not sure if that's a good thing but we'll see.

Limits on Basic plan are back

In v3 we temporarily removed certain limits around notebooks, tags, and colors. We are adding them back with a slight difference: you now get 20 notebooks (instead of 3) in the basic plan. Everything else is exactly the same.

Prompt to take backup before logout

Notesnook will now always prompt you to take a backup before logging out. The reason is simple: we don't want you to lose important data. For example, sometimes you are having connectivity issues, or the sync is broken for some other reason, and logging out erases all copies of your data. This is bad for everyone.

Additionally, the app will also warn you if you have unsynced changes on logout making sure you are fully aware.

I think this'll save you from a lot of headaches.

Faster image loading in editor

This was a constant complaint from a lot of users (especially on Reddit). Locally cached images should load much faster now (remote images are dependent on network speed so you probably won't notice as much of a difference there).

Bug fixes

As usual, this release fixes a lot of annoying bugs. I recommend checking out the commit history for a complete list.

Read the full commit history here.

Previous releases:

• v3.0.12 fixes 9 bugs via 16 commits. Faster attachment downloads, update availability indicator fixed on desktop app, and added support for clearing attachment cache.
• v3.0.11 fixes 10 bugs via 24 commits. Editor session data is now stored encrypted by default, fixed various editor related issues especially with pasting content, and other performance optimizations.
• v3.0.10 fixes 5 bugs via 6 commits. Fixed weird UI glitches when scrolling in different lists, Pro popup is now shown only if there are images when pasting, and markdown shortcuts are working again.

Fixed attachments flicker in note properties

Flicker when scrolling the properties sidebar with a lot of attachments (50+) is now gone.

Pressing Enter now moves the focus to the Editor

A minor UX improvement but you can now press Enter to directly focus the editor (instead of using the mouse or Tab).

Fixed crash on moving a temporary tab

This crash was most probably occuring due to the migration we did in v3.0.11 from immer to mutative. For some reason (I haven't investigated why yet), using splice on an array adds an undefined item at the end of the error causing the crash. This has now been fixed with a workaround.

Fixed error when setting a yearly reminder for January

This was a long standing bug from v2. In Notesnook, reminders work using a Task Scheduler that uses Cron expressions to schedule different tasks (e.g. update checks, reminders etc.). The error was occuring because in JavaScript, months are indexed from 0-11 while Cron expects 1-12. So an expression like this 0 0 0 15 0 * * causes a crash.

This has now been fixed.

Read the full commit history here.

Previous releases:

• v3.0.11 fixes 10 bugs via 24 commits. Editor session data is now stored encrypted by default, fixed various editor related issues especially with pasting content, and other performance optimizations.
• v3.0.10 fixes 5 bugs via 6 commits. Fixed weird UI glitches when scrolling in different lists, Pro popup is now shown only if there are images when pasting, and markdown shortcuts are working again.
• v3.0.9 fixes 15+ bugs via 28 commits. Fixed web app for mobile browsers, images now automatically get removed on paste for non-Pro users, and real-time editor sync now works again.

Faster attachment downloads

Ever since we added support for attachments in Notesnook, we have been serving all the files from a single location (Germany). Naturally, this doesn't scale very well for people located all over the globe (i.e. anywhere outside EU).

Starting from now, we are using Cloudflare CDN to serve attachments to users which means you'll see much, much faster download speeds regardless of where you are located.

Note: Your attachments are always encrypted on your device before being sent to the server so no one, us or Cloudflare, can read or access those contents. The only thing they see is an encrypted blob. Not even the filenames are visible so your attachments are 100% secure - just a lot faster now.

Fixed update indicator on desktop app

Basically, the desktop app didn't automatically check for updates nor did it show whether an update was available or not. This created the false illusion that the app was on the latest version.

Of course, the update did happen in the background so there was nothing to worry about but still, seeing no indication creates a lot of confusion.

This has been fixed now.

Added support for clearing attachments cache

You can now clear the local attachments cache in case you are facing a persistent issue with an attachment (e.g. attachment not downloading because the app thinks it's already downloaded).

This should only be used for troubleshooting purposes. If you are facing an issue repeatedly, please report it to us via email at support@streetwriters.co

Read the full commit history here.

Previous releases:

• v3.0.10 fixes 5 bugs via 6 commits. Fixed weird UI glitches when scrolling in different lists, Pro popup is now shown only if there are images when pasting, and markdown shortcuts are working again.
• v3.0.9 fixes 15+ bugs via 28 commits. Fixed web app for mobile browsers, images now automatically get removed on paste for non-Pro users, and real-time editor sync now works again.
• v3.0.8 fixes a critical bug where the app would crash on start up if app lock was enabled.

Editor session data is now stored encrypted by default

Ever since we released tabs in v3, we have been storing the editor session data (i.e. data related to opened tabs) in LocalStorage. This worked fine but it leaked the note titles for all the tabs you have opened in Notesnook.

Starting from this version, all your tabs data will be stored alongside your notes & other data encrypted by default.

Note: After upgrading to v3.0.11, all your opened tabs will automatically be closed. This is a one time operation and everything will work as usual afterwards.

Fixed various pasting issues in editor

Pasting content and making sure it appears "just" right is a pain. In this release, pasting content containing lists will work much more smoothly. We have also fixed a long standing issue where pasting multiple lists only pasted the first list ignoring everything else.

Fixed updating a link creates a new link beside it

This issue only appeared in the web/desktop app when updating the link via the hover popup. The editor was trying to update the link based on the current cursor position which could be anywhere, causing it to think that it should add a link instead of updating the existing one.

Fixed editor not scrolling

Since v3, we have been saving and restoring scroll position for all notes. To keep things working for really long notes, we set a minHeight to the scroll container in case the note wasn't done loading yet. This made sure that the scroll position would be correct once the content was loaded, however, it also broke the scroll because now the scroll container was the same size as the content inside it.

Performance improvements

Nothing major related to performance except we have gotten rid of immer and replaced it with mutative for immutable state management inside the app. mutative is almost 10x faster so you'll notice slight improvements in app responsiveness.

In this release, we have also refactored how dialogs & modals are loaded and shown. Previously, we had all the modal showing logic in one module which was really bad for treeshaking and page load times. We have now isolated each modal to its own module so app load times will be much, much faster.

Read the full commit history here.

Previous releases:

• v3.0.9 fixes 15+ bugs via 28 commits. Fixed web app for mobile browsers, images now automatically get removed on paste for non-Pro users, and real-time editor sync now works again.
• v3.0.8 fixes a critical bug where the app would crash on start up if app lock was enabled.
• v3.0.7 fixes 15+ bugs via 42 commits. Themable title bar, logs are now stored in a SQLite database, 10x faster web app loading, and undo/redo buttons are back.

Fixed crashes when running the web app in older browsers

Notesnook heavily depends on OPFS for SQLite to function properly. For older browsers we also provide an IndexedDB based fallback. Since OPFS doesn't currently support access to the same database from multiple tabs, we have also implemented a shared service which basically shares the same connection across tabs. This works for the OPFS backend but fails spectacularly when the IndexedDB backend is used.

It turns out browsers natively support multi tab access in IndexedDB so there's no need to use our shared service when using the IndexedDB backend. This fix is similar to the one we made for Notesnook to run on mobile browsers in v3.0.9.

Fixed markdown shortcuts not working in editor

This was caused by a fix we added in order to support changing editor settings without restarting the editor. However, TipTap currently doesn't support reusing the same editor while refreshing the plugins/extensions so it caused various issues in different extensions and also broke the markdown shortcuts for almost everything.

In this release, we have applied an alternative way to support changing editor settings in real time.

Fixed Pro popup shown even if text is pasted

This was mostly due to laziness: we were checking (and showing the popup) for images access even if there were no img tags in the pasted content.

Fixed scroll glitches in tags & other lists

These scroll glitches have been there since v3.0.0, and were being caused by wrong default item size being given to the underlying list renderer. Notesnook heavily uses virtualization to render insane amount of items, but that means we have no idea exactly how large the list can be so we use the next best thing: a rough estimate.

The glitch was occuring because the list's estimate of the total height was 2x more than the actual height.

Read the full commit history here.

Previous releases:

• v3.0.8 fixes a critical bug where the app would crash on start up if app lock was enabled.
• v3.0.7 fixes 15+ bugs via 42 commits. Themable title bar, logs are now stored in a SQLite database, 10x faster web app loading, and undo/redo buttons are back.
• v3.0.6 fixes an annoying issue where notes with no actual conflict appeared as conflicted.

Web app for mobile browsers

Ever since the v3 release, the web app has been completely broken on mobile browsers. Users couldn't even load the login/sign up page all because mobile browsers currently do not support SharedWorker which is required for cross-tab sharing of an SQLite connection.

We have fixed this by disable multi-tab support on browsers that don't support SharedWorker (e.g. Chrome & Safari).

Fixed real time sync not updating content inside editor

This annoying bug was caused by a check we added to prevent newly made edits from being overwritten by a delayed real time sync. That worked by comparing the time of the last change with modified time on the synced item. While that functionality worked, it also started ignoring valid syncs for notes that you just opened or if you restarted the app.

The issue was caused by this line of code:

const lastChangedTime = useRef<number>(Date.now());

Later on when a real time sync would occur, we'd check it like so:

if (isContent && lastChangedTime.current < item.dateModified) {
  // ...
}

For newly opened notes (or if you restarted the app), the value of lastChangedTime would always be greater than item.dateModified causing the app to continuously ignore the sync until you made an edit.

The fix was simple:

const lastChangedTime = useRef<number>(0);

And viola! Everything works again.

Images are now removed automatically on paste for non-Pro users

This was causing annoying issues where non-Pro users were able to paste images but it would break their sync. Starting from this version, all images will automatically be removed on paste (without affecting anything else) for non-Pro users.

If you are on the Basic plan and getting "unable to resolve attachment url" errors over and over again, follow these steps to resolve the issue:

1. Go to Settings > Profile > Attachments manager
2. Switch to the Uploads tab
3. Select all the pending uploads
4. Delete them

This will fix your sync.

Read the full commit history here.

Previous releases:

• v3.0.6 fixes an annoying issue where notes with no actual conflict appeared as conflicted.
• v3.0.5 fixes 10+ bugs via 37 commits. Improved conflict handling during sync, fixed web app on Safari, added support for duplicating locked notes, brought back Ctrl + F to search all notes, and fixed search/replace in editor.
• v3.0.4 fixes a critical bug with 2FA emails/SMS not getting sent during login. Everything else is the same as v3.0.3.

Themable title bar

We have added a new theme scope to independently theme the title bar in the desktop app. Here's how it looks:

You can also theme the individual tab items using the same theme scope.

Logs in SQLite Database

In v3, we migrated everything except app logs to SQLite. Unfortunately, in the last few versions users have reported sudden app hangs and other lag issues. This occured whenever the app tried to clear the old app logs which could be in the millions. The mobile app was most affected by this and issues like notes not saving also occured.

In this version, we are now moving the logs to SQLite fixing all these issues.

10x faster web app loading

I recently read brr's Engineering for Slow Internet and Dan Luu's How web bloat impacts users with slow devices, and decided to benchmark the Notesnook Web app on a throttled slow 3G internet connection to see how it performs. No surprise. There was a lot of room for improvement.

Our web app was taking around 1.5 minutes to fully become operational. That is not the nicest experience. The worst part is how it just sat there for 100 seconds stuck on the loading screen. Whenever something like this happens, the first thing to check is how the app is being bundled i.e., if there are too many or too few chunks, the loading times will increase dramatically.

In our case, the bundling was completely broken. We were loading a ~450 KB chunk upfront and then very slowly loading the other chunks almost sequentially. Notesnook is a PWA so, naturally, it uses a service worker to precache all assets for later loading. Unfortunately, it was precaching too many unnecessary modules causing a significant slow down for first time users.

The optimization was simple: slim down the bootstrap module & load the service worker as early as possible to load all the precached modules in parallel. An additional step was to break down a few big chunks into smaller chunks to ease loading (but that only helped a little).

The result? The web app now loads in 10-15 seconds on a slow 3G internet connection.

Undo/redo buttons are back

In v3, we removed the undo/redo buttons on desktop/web app (because there are keyboard shortcuts right?). On the mobile app, we moved them inside the drop down menu. After several user requests, we are reverting this change.

SQlite on another thread

In the desktop app, we were running SQLite queries on the same thread as the app. This worked alright for fast queries but caused significant lag for slow or too frequently used queries e.g. when editing the note. We have now moved SQLite to its own thread so it should no longer block the main thread when executing queries creating a much smoother experience.

Use native title bar on desktop app

A few users requested that they do not want the custom title bar with integrated tabs so in this release, we are adding an option in Settings > Desktop integration to disable the custom title bar and use the native one instead.

Fixed sync not running on window/page focus

We have fixed an issue causing the sync to not run when the app was brought into foreground either after minimizing or moving the focus away.

Fixed extra padding around images

This was reported early on in v3 but we couldn't get to it due to other more critical issues. This release fixes the bug and all your images should automatically appear correctly.

Previous releases:

• v3.0.4 fixes a critical bug with 2FA emails/SMS not getting sent during login. Everything else is the same as v3.0.3.
• v3.0.3 fixes 15+ bugs via 40 commits. Replaced force sync with separate force push & force pull buttons, added various fixes to real-time sync, improved editor reliability on mobile & fixed export of locked notes.
• v3.0.2 fixes 10+ bugs via 24 commits. Attachment manager for logged out users, much improved attachment handling fixing a couple of critical issues, pre-v3 backups no longer throw errors, and many other fixes.
• v3.0.1 fixes 20+ bugs via 65+ commits. This release adds SQL based search, improves editor performance & add support for multiline search replace in editor.

Improved conflict handling during sync

Ever since releasing v3, sync related issues have almost been reduced to 0 (emphasis on almost). While we fixed "my notes aren't syncing", we now have a new issue: "my note got reverted to an older version". I don't know which is worse but in this release, we tracked down and fixed this issue as well.

Here's a scenario:

1. You are editing a note while offline on your laptop.
2. A few hours later, you open and edit the same note on your mobile (which is online and syncs the changes immediately).
3. Next morning, you open your laptop, sync runs, but you don't see the changes you made on the mobile. You open your mobile app and see that the note has reverted all your changes.

At this point, you either delete the app or, if you are handy with a phone, you restore your changes from the note history. The question remains though, why did this happen? Shouldn't newer changes almost always take priority over older changes in sync?

Turns out we were bumping the dateModified property on each item after pushing it to the server. If you remember from my previous posts on how the sync works, we always set the synced property to true after syncing each item. What happened was, we were also bumping the dateModified property along with changing the synced property.

How does the app know which item is newer? By using dateModified. So imagine that you edited something at 5 PM but synced it at 10 PM. What would be the value of dateModified? 10 PM. And that is the bug.

The fix was simple. We make sure that nothing touches the dateModified property. However, that still doesn't fix the problem.

Even if the above issue never occurs, you'll notice how your unsynced changes from the laptop would get replaced by the newer changes made on your mobile device. Is that really the intended behavior? What if you noted down something really important?

To handle this unique situation, Notesnook will now trigger a conflict if the version of the item you have on your device isn't synced. It won't care if it is older or newer. If it is unsynced that means there is important information and you should have the choice of how to preserve the information.

Fixed note duplication (including support for duplicating locked notes)

v3 broke note duplication almost completely. While we were duplicating the title & content of the note, everything else, like the notebook, tag or color, was completely ignored. This is now fixed.

Another unintentional limitation was that we didn't allow duplicating locked notes (for some reason). That made no sense, though, so it has been removed.

Bring back Ctrl + f to search all notes

I didn't even know this was broken until I tried to search in a readonly editor and noticed the notes list flickering like a light bulb. Turns out it was trying to navigate to /notes/search which no longer exists. We now handle all searching within the same route. This is now fixed and pressing Ctrl + f anywhere outside the editor will open notes search.

Fixed web app not working reliably on Safari

Safari has some really frustrating problems when using Workers. It doesn't auto close a worker when you navigate or refresh the page, it also doesn't free any WebLocks automatically. This results in the app getting badly stuck on load, and the only way to work around it is to close the tab and open the app in another tab. Not really convenient.

This has now been fixed. Notesnook now works on Safari just like on other browsers.

Fixed password/pin based app lock on Android

This issue took us multiple days to figure out. And the fix?

We were using the wrong size salt: 12 bytes instead of 16 bytes. Turns out that triggers undefined behavior instead of throwing an error. Fixing this was as easy as replacing the old salt with new one.

What about people who already have app lock enabled? Well, we have added an option to remove the app lock using your account password. If that doesn't work, you can always just reinstall the app (not as convenient but no other way, unfortunately).

Fixed pricing plans stuck on loading on Android/iOS

This issue wasn't highlighted a lot even though it has been occurring for quite some time. Notesnook uses regional pricing which requires getting the appropriate SKU/ProductID depending on where you are located. This is handled by a Cloudflare Worker.

When we were migrating the Notesnook Core to TypeScript, I had changed the signature for the class responsible for communicating with the Cloudflare Worker. Unfortunately, I forgot to make the appropriate changes in the mobile app resulting in the app always getting stuck when getting the pricing information.

This has now been fixed, and you'll be able to purchase a new subscription from Android/iOS just like before.

Taking screenshots with app lock turned on

Normally when you turn on the app lock, the app automatically disables screenshot taking. This is the default behaviour. However, sometimes you might want to take screenshots without disabling the app lock.

In this release, you can disable Privacy Mode from Settings (on by default when you enable app lock) to take your screenshots.

Previous releases:

• v3.0.2 fixes 10+ bugs via 24 commits. Attachment manager for logged out users, much improved attachment handling fixing a couple of critical issues, pre-v3 backups no longer throw errors, and many other fixes.
• v3.0.1 fixes 20+ bugs via 65+ commits. This release adds SQL based search, improves editor performance & add support for multiline search replace in editor.

Replaced force sync with force push/pull

The reason is simple: force sync is rarely useful on its own and, more often than not, it causes data loss. However, we can't just remove it because there is sometimes need for a "force" sync. I also think a lot of users have been misusing "force sync" as an alternative to auto sync because of sync issues that were common in v2. That is no longer the case which is why we are replacing "Force sync" with separate buttons for "Force pull" and "Force push".

In v2 (and v3), "Force sync" used to work as follows:

1. Get everything that's on the server
2. Send everything that's on the device

In most cases, one of the above steps is unnecessary because either you want to get everything from the server or send everything from your device to the server. In cases where you need both, it's always better to control the sequence of those 2 steps.

NOTE: As mentioned in the screenshot above, this should never be used except for troubleshooting purposes. For 99.99% of cases, auto sync should work and you should never face a scenario where "force pushing" or "force pulling" is needed.

More reliable mobile editor

We have recently been getting a couple of bug reports from (mostly) mobile users where their edits are not saved. This is a critical issue and in this release we have added various fail safes to prevent critical data loss.

In the mobile app, the editor and the app are basically 2 different processes and they communicate internally through an IPC. The editor runs inside a WebView and any edit you make gets sent to the app for storage and syncing. Sometimes, however, this IPC can fail or stop responding resulting in data loss. To prevent such issues, we have now added fail safes which will notify you if the communication with the app is broken, or if saving a note takes too long. You can then take extra measures such as copying your changes.

This is not a common occurence, by any means, and the app will try to automatically recover your edits (if possible).

Fixed File already exists error on duplicate downloads

Downloading the same file over and over again (i.e. when you have multiple copies of an image in a single note) will no longer fail with the File already exists error.

Fixed database disk image malformed error

This issue was partially fixed in v3.0.1.

By default, SQLite FTS5 indexes everything in the table and there's no way to exclude anything. To avoid the unnecessary indexing of locked notes (which are basically gibberish), and permanently deleted notes (which don't have anything worth indexing), we use SQLite triggers with some conditions. The problem occurs when SQLite tries to deindex something that wasn't indexed in the first place.

This can happen, for example, when syncing (or restoring a backup) that contains locked notes and then permanently deleting those notes from trash. Unfortunately, debugging this is next to impossible due to very little information exposed by SQLite.

This version also rebuilds the whole FTS5 index (so if you have a lot of notes it might take some time to start the app after upgrading). This is necessary because due to incorrect logic, previous versions were indexing blacklisted items that shouldn't be indexed. To properly fix the issue, it was necessary to reindex everything.

Fixed edge case during sync causing some items to be missed out

While the new sync engine handles everything without jumping through a whole lot of hoops, it isn't immune to some edge cases. The problem is simple: what would happen if an item gets updated right when it is being pushed to the server?

If you remember from the Introducing Notesnook v3 blog post, the sync engine basically operates on the value of synced. Now imagine the following scenario:

1. Item A is edited (it's synced property is set to false)
2. Sync engine pushes Item A to the server
3. Sync engine sets synced property of Item A to true

All well and good so far, but what if Item A gets updated between step 2 & 3? Oops. The change will never be pushed to the server because it's synced property will be set to true in step 3.

To circumvent this edge case, we now only toggle the synced property if the item wasn't changed while it was being pushed to the server. Thanks to SQLite, this only requires adding the following condition:

WHERE dateModified <= timestampBeforePushStarted

This fixes the issue but the item still isn't synced until the next sync is run (which can never happen if nothing else changes). That is why, right after the sync completes we check if there are any items that were modified during the current sync cycle, and if so, those items immediately get sent to the server. In this way, your edits are never missed.

Other changes

• Fix tests 919524489
• Fix image filename in picker 152794ccd
• Fix editor content update on realtime sync 2e8b234b6
• Add Audios tab in attachments dialog 055c64769
• Fix real time sync test 3c8b8a7bc
• Saving timeout notice shown every time fde45fb6d
• Fix tab not updating when note is locked/unlocked 4a616a3e6
• Fix dateEdited not updating on saving locked content bd0a338dd
• Fix async iterator on sql collection only returning dateCreated & id 5ab721e3e
• Fix errors cb70bb942
• Show error if saving takes more than 30 seconds 82cadd473
• Fix editor loading 0e8ea3dde
• Handle editor not responding 511acc5fc
• Add editor lock safety 001cf8ee9
• Fix color not updating on note (#5573) a965cd694
• Fix wording of push/pull sync d3c1c1959
• Replace force sync with force push/pull 9a866a552
• Push/pull force sync 837c29682
• Fix locked notes not getting exported 9aed6faed
• Fix crash due to undefined is not an object (evaluating 'a.nodeSize') (#5553) 734f491e8
• Fix editor crash due to position (#5519) 0ea13024e
• Close shared service on window close cb2703924
• Do not use auth access tokens as normal access tokens 714ac2dea
• Fix crash on toggling custom dns (#5538) d605bc29b
• Fix database disk image malformed error (#5525) 080101bc4
• Rerun sync if there are unsynced changes after sync complete 4819e17da
• Fix crash when taking camera picture 68a6d6c31
• Fix camera permission c51ef4d5f
• Remove margin in editor d9c5c1f89
• Fix editor scrolling on update 5a75ca73a
• Use yarn instead of npx for build scripts 626d39337
• Fix legacy backup restoration 68d06ff3f
• Fix File already exists error on duplicate downloads 79f20d100
• Handle case when updating item while a push is ongoing ac96354b4
• Set synced to false on removing content by note id 63f44d6fb
• Set synced to false on unlinking relations f9bfa88c8

Previous releases:

• v3.0.1 fixes 20+ bugs via 65+ commits. This release adds SQL based search, improves editor performance & add support for multiline search replace in editor.

Attachment manager is now accessible without logging in

This is especially useful when you are restoring backups in order to see find or restore a specific attachment without first logging into an account.

Fixed unnecessary attachment overwriting during sync conflict

There was a logical error in our sync process causing all attachments to get overwritten with their locally cached files removed. This logic was added to handle the edge case where 2 devices upload the same attachment. However, it also triggered when that wasn't the case.

This bug is also the reason why your locally cached images & PDFs sometimes get removed and have to be redownloaded.

Fixed account recovery redirecting to the sign up page

This issue was surprising especially because we didn't touch anything related to auth or account recovery in v3. Turns out we were double initializing the SQLite database during the authentication step which throws a Driver not initialized error. Any error during the authentication step just redirects the user to the sign up page (this is probably not a good idea and we should show the actual error instead).

This has now been fixed and account recovery should work as before.

Fixed unnecessary attachment uploading on a failed recheck

There was a really weird issue causing an attachment to unnecessarily be marked for uploading any time an error occured during download or recheck. The constantly happened even if the error was due to a network issue.

Fixed Invalid backup on restoring some backups

Last year when we changed our backup format to a .zip file, we used to store an empty .nnbackup file for "verification" purposes. Unfortunately, when taking a backup before migrating to v3, this empty file wasn't written to the backup file causing the Invalid backup error on restore.

In this release, we have removed this check as it wasn't very foolproof in the first place. This means that trying to restore a random .zip as a backup file will probably fail in some other unexpected way.

(Properly) fixed Please login to create an encrypted backup. error during migration

In v3.0.1 we fixed this error but the root cause was not addressed. When you migrate to v3 from v2 app, it takes an automatic backup. This backup is taken using the "legacy" backup logic that doesn't use SQLite etc.

The problem occured when due to some unexpected reason, the user's account information got removed from the legacy database. This made the app think that the user wasn't logged in and, hence, threw the error.

Since the most important thing is to backup the data before migration (not the encryption), the app now automatically turns encryption off if it cannot find the user when taking the "legacy" backup. NOTE: This is only for legacy backups. Taking a v3 backups with encryption turned on but without user information will still throw an error.

Other fixes

• Fix image picker on mobile by @ammarahm-ed #5304
• Fix n.startsWith is not a function by @ammarahm-ed #5266
• Fix attachment grouping and adds logging by @ammarahm-ed #5267
• Fix note not opening from pinned notifications by @ammarahm-ed #5300
• Fix crash due to unsanitized sort options by @alihamuh #5324

SQL Based Search

Notesnook now supports the full FTS5 search syntax. Here's a quick summary about what it'll enable:

• Wrap a phrase in quotes (e.g. "<phrase>") to run exact search
• Simple queries (such as "best blog ideas") will look for the words best, blog & ideas and show all notes that contain these words regardless of their sequence.
• You can use boolean operators OR, AND & NOT to further narrow down results. For example: notesnook OR evernote will show all notes that either have the word notesnook or evernote in them.

The FTS5 query syntax supports a lot of functionality which you can read about here.

Multiline search & replace

You can now search and replacing across lines using Regex.

I have also improved the overall UX of search replace so it now works much more smoothly:

1. Turning on Regex search automatically reruns the search without you having to press Enter again. Same for toggling other things like Match whole word, Match case etc.
2. Shift + Enter moves to the previous search result.

Fixed database disk image is malformed error on sync

This error occured whenever the sync engine tried to update a deleted note or content item. Deleted items have the following structure:

{
  "id": "some_long_hex_id",
  "deleted": true,
  "dateModified": 100000000000,
  "synced": true
}

Whenever a content or a note item is updated, NN runs an SQLite trigger that updates the FTS5 search index with the new values. This worked in most cases but when it tried to update the index based on the deleted item, it didn't find the required fields (noteId & data) resulting in the above error. The bug didn't affect any data or cause any permanent corruption.

The fix was to only run the trigger if and only if the item isn't deleted and has all the required fields.

You can review the changes in this PR: #4957.

Fixed editor crash with error Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node.

Upgrading to React 18 brought with it a bunch of stupid crashes. This particular crash occurs in such a way that there's no way to catch it. Let's start from the beginning:

In order to render custom react node views inside the editor, we have to use React Portals. However, ProseMirror doesn't actually support the React way of doing things. ProseMirror is 100% synchronous while React is asynchronous and operates on a virtual dom. The problem occurs when ProseMirror removes a DOM node which is still present in React's Virtual DOM resulting in the above crash.

That's not all, using React Portals also causes recursive & excessive updates to the underlying node view making the editor super slow as the number of custom node views increase (e.g. too many task items in a task list). I haven't investigated why this happens, though.

In any case, the fix was to get rid of React Portals and use a new React 18 createRoot for every node view. Sounds excessive but trust me, it works much more smoothly. The only loss is that now node views don't share the parent context which isn't a huge deal: the only context we require is the Theme which can be reapplied as necessary.

Before this change, it took 12 seconds to check 100 task items. Now it takes 1 second.

You can review the full changes in this PR #5028

Other fixes

• Fixed moving notebook on iOS (43fac7901)
• Fixed scrolling broken in reminder -> repeat -> month (167c54578)
• Fixed theme search returns empty results (c8c75d40d)
• Fixed footer size for notebook screen (bace90808)
• Fixed notebook-sheet position and flicker (fe7c7e8db)
• Fixed selection header (716239abf)
• Fixed vault unlock with biometrics (62dd5a541)
• Fixed search bar position on iOS (96558c5df)
• Fixed confusing settings/sync button (95b511407)
• Fixed back navigation from editor (20742e2a1)
• Fixed opening internal link in readonly mode (d77c09f1f)
• Fixed position of context menu (aa602ea8e)
• Fixed sidebar order not loading on app launch (404d136a7)
• Fixed placeholder showing always in first line of editor (cf9aeecd7)
• Fixed many papercut UX issues in search replace (1adda96ce)
• Fixed middle pane size increasing on exiting focus mode (b8c68b516)
• Fixed position of image preview toolbar (249600489)
• Fixed navigation menu resize issues (781d09dac)
• Fixed toggles in properties not working (2ea9b0486)
• Fixed database disk image is malformed error on updating deleted content (5dbabc270)
• Fixed various editor crashes (d85974ed7)
• Fixed wrong version in update sheet (9598ea754)
• Fixed multi-selection UX (42048ad53)
• Fixed crash during backup (1fbd2efb9)

In this release we have rewritten the core architecture of Notesnook, introducing a new Sync Engine, migrating to SQLite, adding support for internal note links, tabs and nested notebooks, alongwith countless big and small improvements to the UX. v3 is the rebirth of Notesnook as a more mature, more stable note taking experience.

There's a lot to talk about in this release but let's start with the new Notesnook logo.

The new Notesnook logo

When we started out building Notesnook, our logo was the literal visual representation of "notes" and "nook". That concept quickly got outdated after rapid iteratation that completely changed how Notesnook functioned. Despite all the changes, though, we are still engineers at heart which means we think of everything in terms of "problems" and "solutions". The old logo had a couple of problems:

1. It wasn't legible in small sizes (e.g. favicons, tray icons, status bar icons etc.)
2. It couldn't be themed
3. It didn't work well with different colors
4. It had a very busy design

The new logo solves all of these problems and it looks great.

Migrating to SQLite

If you have been using Notesnook you would never notice that all of it is built on a very simple key value database. KV databases are really cool but fail miserably if you want to selectively query data, or do partial updates. As a result, when you increase the number of notes in Notesnook, the performance becomes abysmal. I am talking about 30+ seconds to startup the app with 50K notes on iPhone 6s, laggy scrolling, and a simple note taking 10s to save on each edit.

Since this only occured for 20K+ notes, we could afford to be slow for some time but sooner or later we needed a permanent solution. We had the following options:

1. Optimize the slow parts of the database (essentially building our own database & query engine) and continue shipping.
2. Migrate to SQLite

Building your own database engine is really not a good idea. I wish we had seen this while prototyping Notesnook because while choosing a KV database sped up development it forced us to repay that cost later on. Using the right tool for the job is crucial for any serious software development.

To decide our next steps, we set down a few targets:

1. The clients should perform predictably regardless of how much data you have. Loading 1000 notes should take the same amount of perceivable time as loading 50K notes (i.e. using lazy loading, pagination etc.)
2. The clients should use as little RAM as possible to work in extremely constrained enviroments (e.g. our web clipper shouldn't crash on iOS which limits all Share Extensions to around 50mb of RAM).
3. Instant startup times regardless of how many notes a user has.
4. Future proof (i.e. we shouldn't need to migrate again)

And a couple of good to haves:

1. Scrolling a list with 50K notes at 60 FPS
2. Improved search
3. Faster saving of notes

Keep the above in mind, the choice was obvious: it was time to migrate to SQLite.

In v3, you will notice the following improvements immediately:

1. Instant startup even with 50K+ notes (1.5s vs 30s on iPhone 6s)
2. Lag free scrolling & navigation
3. Exporting notes & taking backups should be faster
4. Search should be faster and more accurate
5. Faster sync (thanks to the power of SQL)
6. Web clipper on mobile should no longer crash if you have a lot of notes

After migration, the next obvious step was fixing the sync. Specifically we wanted to fix one of the longest standing issue with Notesnook Sync: a change you make on one device sometimes wouldn't sync to other devices and vice versa.

Fixing the sync

From the beginning, Notesnook has had a decentralized sync system where each client can independently sync items without depending on a central server. This could only work based on time, of course, but it also had a few drawbacks:

1. Since each client was independent, it was a nightmare to debug why something wasn't syncing.
2. In order to be efficient, we detected changed items based on their modified timestamp but this forced us to juggle with the various inconsistencies of time on different devices.
3. Building everything on top of timestamps meant resumability during sync could never be stable.

As you can imagine, in order for a time based sync system to work without issues, time must be the same on all devices at all times. What happens if one device is ahead/behind by a few milliseconds? Items get missed out of the sync cycle, and you have to run a force sync (which sends & fetches all the items instead of only the changed ones).

It was clear that to properly fix the sync we had to get rid of the time factor. Turns out a centralized architecture is the best way to solve this problem:

1. Each item has a boolean synced property that becomes false whenever it is changed.
2. When pushing changes, we just get all the items with synced set to false.
3. The server keeps a list of all unsynced items for each device, and when a device runs the sync it only sends those items.

This fixes all the problems with a time based sync engine:

1. Debugging is easier because server has a list of all changes for each device.
2. Detecting changed items is just as efficient as comparing their modified time but more stable.
3. Resumability comes built-in.

As a result, in v3 you'll notice a much more reliable sync that "just works" regardless of where you are, how many devices you are on, or the time difference between them.

Background sync on mobile

Notesnook mobile apps will also now automatically sync your notes and other data in the background at regular intervals. This will ensure that you are always synced even if you never open the app. For example, setting a reminder on the desktop/web app will automatically set it on your phone as well (without requiring you to open the app).

Background sync can be disabled from Settings > Sync Settings > Background sync.

Merge conflict tolerant sync

In v2, whenever a merge conflict occured the sync would stop until you resolved all the conflicts regardless of whether you made changes in the conflicted note(s) or not. This was quite frustrating.

In v3, we have fixed this: the app will now continue to sync even if you have merge conflicts.

Features, Features

It is always a struggle to decide which features to add and which features to leave for later. v3 is no different but even then, it is probably one of our biggest releases ever.

Note linking

The Crown Jewel of v3!

After a long excrutiating wait we have finally added support for linking 2 notes in Notesnook. Not just that, you can also link directly to a specific block inside a note. Clicking on the internal link takes you directly to that block.

We also added controls to quickly see which notes are currently linked, and which other notes are referencing a particular note.

To keep things simple, a note link is no different than a normal hyperlink except that clicking on it will take you to the note instead of an external page. When you export your notes, your note links are automatically resolved to actual Markdown/ HTML files. This is something no other app (that I know of) does instead keeping the links in their app specific format (with note id and everything) making them essentially useless after export.

Tabs

The only reason we added tabs was to allow quick navigation to/from a note on clicking a note link. You can, of course, use tabs without ever linking a note.

Notesnook is one of the few note taking apps (besides Obsidian & OneNote) that has a full fledged tab experience. With v3, we are slowly upgrading Notesnook to become a poweruser's tool while keeping things just as simple as before. Which brings me to...

Nested notebooks

With v3, we are getting rid of "topics" as an organization concept, and replacing it with "subnotebooks". All your topics will automatically convert to subnotebooks after upgrading to v3.

Subnotebooks function similar to a topic except that you can have unlimited levels of subnotebooks. For example, a structure like this was not possible in v2:

- Blogs
  - Programming
    - JavaScript
    - Python
    - C++
  - Privacy
    - Notesnook
    - Android
      - GrapheneOS
      - Other OSs

Complex structures like this are now possible in v3, and they work just like they did in v2 so you'll feel right at home.

At rest encryption

Notesnook was always end-to-end encrypted i.e. your notes always got encrypted on your device before being sent to the cloud. However, those notes weren't stored encrypted on your device. For some users, this was a big no-no.

With v3, we are fixing this short coming of Notesnook. Thanks to SQLite (and sqlite-multiple-ciphers), at rest encryption is now a thing on all platforms. When you first open the app, it will automatically generate an encryption key and store it securely in the platform KeyStore/KeyChain. This encryption key is then used to encrypt/decrypt the SQLite database.

In other words, it "just works" without any intervention required on your part. All sensitive data is encrypted except:

1. App logs
2. On-device settings & configuration

App lock

At rest encryption works with or without app lock, but it is recommended that you enable it nonetheless especially on the web app where there is no platform KeyChain/KeyStore.

Web/Desktop

When you enable app lock, it further encrypts your database encryption key with your app lock pin (or security key) so it's not just an "overlay". If you forget your app lock pin, the only way into the app is to reset & clear the database and start over.

You can also setup app lock with your hardware security key (e.g. YubiKey/SoloKey) on Chromium-based browsers & the desktop app. Firefox & Safari, unfortunately, still do not support the prf extension which is required for this to work.

iOS/Android

On iOS/Android, the app lock is independent of at rest encryption i.e. setting up app lock doesn't further encrypt your database encryption key with the app lock credential (e.g. password/biometrics). This is done intentionally due to the following limitations:

1. Background sync cannot work if app lock is turned on.
2. Snoozing/dismissing of reminders becomes impossible because the database cannot be opened without asking the user for the app lock credential.
3. Web clipper on mobile cannot work for similar reasons.

However, this is not a huge concern because the database encryption key is already stored very securely in your phone's KeyStore/KeyChain. In the future, we plan on working around these limitations or offering a "Super Secure" mode as an opt-in feature on mobile to disable these extra features.

Export attachments with notes

In v3, we have improved the export process to include:

1. Attachments are now exported as separated files (both files & images) instead of getting embedded inside notes.
2. Notes are automatically organized based on the notebooks they are in.
3. Internal note links are resolved to actual HTML/MD files
4. Notes & notebooks with duplicate names are now properly renamed for deduplication.

User profile

In v2 we added the ability to personalize Notesnook using themes and in v3 we are taking that a step further by allowing you to set up your profile. This will add a personal touch to your Notesnook experience. As always, everything is 100% end-to-end encrypted included the profile picture.

Currently your profile is only used for aesthetic purposes. However, in the future we plan to make use of it for Monographs (optionally), collaboration etc.

Custom colors for note organization

Each person has their own color hierarchy. For some, red signifies importance but for others it has a different meaning. Some people can't tolerate a certain shade of red etc. etc. That is why in v3, we are introducing custom colors for organizing your notes.

You can add as many colors as you like with whatever shade you like. No 2 colors can have the same shade, however.

Customizable side bar

The side bar is now fully customizable including:

1. Hiding items you don't use
2. Changing the order of items (e.g. move Notebooks to the top)
3. Reorganizing the order of shortcuts & colors

It can be as simple or as complex as you want.

Callouts

With callouts you can make certain sections of your notes "pop" for better readability. Initially, we have added around 20 types of different callouts which should suffice.

Callouts are also collapsible and nestable so you can add a callout inside a callout etc.

Adding a new callout is as simple as:

>info Callout Title

Table of Contents

If you have very long notes with a lot of headings, navigating around can become really painful. In v3, we have added support for Table of Contents so you can quickly jump around without a lot of scrolling.

Custom titlebar on Desktop app

A desktop app should look and feel like a desktop app instead of just a wrapper around a web app. In v3 we are bringing a fully custom title bar with integrated editor tabs to make things feel more "desktop-y".

With this change, we are making more and more use of the native capabilities of the platform. Even though the web and desktop apps feel similar in functionality, their underlying implementations vary a lot:

1. Desktop app has native encryption, hashing & compression making sync and other things quite a bit faster.
2. Desktop app supports automatic backups that get saved to a folder on your disk.
3. At rest encryption keys are stored in the platform KeyStore/KeyChain in the desktop app, making it much more secure.
4. System tray integration only exists in the desktop app
5. And many other things that really makes a difference.

Change highlighting in merge conflicts

If you get a lot of merge conflicts, or if you are just comparing 2 note versions, it can become really difficult to figure out what actually changed. In v3, we have added change highlighting on all platforms when viewing merge conflicts or note versions.

Image compression & multi image upload

Ever since we added support for attachments, we have avoided compressing images to allow users to attach images in their full quality. The drawback of this approach is that on some slower platforms like mobile, loading notes with a lot of images becomes extremely slow and laggy. Another point to consider is that not all images need to be added in their original quality (e.g. receipts, screenshots etc.).

To fix this performance issue, we are now enabling image compression by default with a toggle to disable it for specific images.

Other features

1. Add support for copy/pasting code blocks with syntax highlighting.
2. The top bar in note properties sheet now remembers which actions to take more frequently and moves the to top automatically. For example if you use the "Copy" action a lot, it automatically moves to start. We have also moved most toggles and single click actions to top bar from the bottom grid.
3. Simple checklists — sometimes you just need a simple checkbox without all the fancy task list features. In this beta version we have added just that. Checklists are barebones version of task lists being extremely lightweight and simple to use.
4. Drag/drop notes & notebooks — you can now drag drop notes and notebooks just like you'd do files on your file browser. Drag a note to a notebook, color or tag and it'll automatically get assigned. Or maybe drag a notebook to another notebook and it'll automatically become its child.
5. You can now sort/group your notes by both title & date.
6. We have added a "New Note" Quick Settings button on Android.

Get v3 now!

This release was one of the most stressful releases ever taking over 8 months of development, and countless hours of testing. None of this could ever be possible without the feedback from our beta users. For the last 3 months, our beta users have helped us find countless bugs & inconsistencies, and we could not be more grateful! Thank you to everyone who contributed, helped, motivated, and shared their feedback.

You can grab v3 from our official website, and also from the respective app store on your platform.

The reader must keep in mind that Notesnook is not a Skiff Privacy competitor, in part or in whole. And as such, this blog post is not meant as a way to take a stab at a competitor. The only part of Skiff that is remotely similar to Notesnook is its Skiff Pages offering, but even that is fundamentally different and solves a very different problem (aimed more as a Google Docs alternative).

Skiff Privacy started out in 2020, publicly launched in 2021-2022, and shut down in 2024. It was a typical VC-backed Silicon Valley startup that quickly gained a lot of traction among the privacy community, but failed to appease its VCs and got acquire-hired by Notion.

A very frequent but unanswered question is why shutdown in the first place? In November 2023, Skiff reported having crossed 2 million users. That sounds like a success but unfortunately, that's not how VC-backed startups work.

The most likely reason for Skiff shutting down is because it has become unviable. You see, Skiff raised around $14 million in seed funding. That's outsider money from VCs which means outside pressure to turn a profit. Since they decided to shutdown, it's obvious that they failed on their promise.

Why Notion, though? It turns out Skiff received funding from Sequoia Capital which is also an investor in Notion Labs. According to Harvard Business Review:

Venture money is not long-term money. The idea is to invest in a company’s balance sheet and infrastructure until it reaches a sufficient size and credibility so that it can be sold to a corporation or so that the institutional public-equity markets can step in and provide liquidity. In essence, the venture capitalist buys a stake in an entrepreneur's idea, nurtures it for a short period of time, and then exits with the help of an investment banker.

Of course, startups fail all the time. That's nothing special but the conduct of the founders in how they carry out a shutdown speaks a lot about what happened, why it happened, and what their priorities/motives were. In this blog post, I want to discuss a few things that stood out to me as completely baffling.

1. Miscommunication

On February 9th, 2024, when Skiff decided to stop operations, this is what they put on their website:

Anyone reading the above would think Skiff is only joining Notion instead of completely shutting down. I mean, they are excited so it must be something good, right? Who is ever excited about shutting down their company? Well, maybe the next few paragraphs would shed more light on the situation?

No mention of shutting down, no mention of discontinuation, not even a single mention of what happens next. Just some vague corporate jargon about "mission" and joining Notion. Their copy sounds like this: "We are joining hands with Notion to continue building Skiff" when it actually means: "Skiff failed to be viable and is being discontinued. The Skiff team is being acquire-hired by Notion."

But where do they even say they are discontinuing? Maybe they aren't discontinuing (and I am lying)!

Click on "Learn about migrating your data" link (why would a user even click on it if they didn't think Skiff is discontinuing?), scroll down and expand the FAQ item:

There it is hidden among paragraphs upon paragraphs of pointless marketing speech. How is a casual user taking just a cursory look at their website supposed to notice and understand this important information? They also sent an email to all their users containing this very letter as if that would give more context?

This is nothing new on part of Skiff. Since its inception, Skiff has portrayed itself as a "transparent and completely open source" product lineup:

However, if you look a little deeper you'll realize only some parts of Skiff are source available (not open source since their license is not OSI approved). For example, none of their backend servers are open source.

There's nothing wrong with being source available (Signal, Proton Mail are all source available or partially open source), the problem is communication. If you claim in one place that you are completely open source then you also have to back it up. This issue was brought up a few times over the years by different users but nothing ever changed. They neither changed their marketing copy nor their license.

2. Causing a panic

What would you do if you received an email about a mission critical (because email is pretty mission critical) product getting shut down? You'd go to the community forum and ask around to know what's going on, what happened, and what to do next.

How would you feel if you opened Discord and the product's official Discord server was gone? You go to their GitHub repo and the GitHub repo is also gone. You open their Twitter/X page but find no clear information about what's going on except "excitement" around joining Notion and a link to a pointless page that tells absolutely nothing. It's evident that you will panic.

Here's a message we received in our own Discord server from a Skiff user:

There are countless such examples of Skiff user's panicking all over Twitter/X. This panic could easily have been avoided through a more transparent and open process.

3. Lack of empathy

I encourage you to read all of Skiff's messaging around their shutting down. You'll notice an absurdly jolly and excited tone ("we are excited...", "...accelerate our mission...", "...next stage of our journey..." etc.) that completely ignores the frustration and disappointment its users are going through. Hidden in all that corporate lingo and marketing jargon you'll scarcely find a genuine apology.

There is a stark contrast between the jubilant tone of Skiff vs. the disappointment and frustration of its users. It almost feels as if Skiff is happy to screw over its userbase, and "excited" to move on instead of understanding and supporting the community (not saying that's the case but it does sound like it).

The 6 month deadline on top of that adds additional uncertainty that could have been avoided through better and clearer communication. If ever there was a time to be positive, this wasn't it. That's like laughing and joking in the face of your neighbor while their house burns down.

Conclusions

As of 11th February, 2024, the @skiffprivacy Twitter/X account is going around claiming that Skiff's open source repos are still accessible and available (after they already took them down once) ignoring the fact that frontend without the backend is useless.

Product shutdowns do occur but if any service is going to shut down, they should keep the following in mind:

Don't lie to your users

Startups fail all the time. That is the nature of startups. But if you are failing, don't try to make it look like a win. Fancy words cannot hide the truth. No one discontinues and shuts down because they "won". Just be honest and communicate clearly. Don't give false hopes like "we are looking forward to...", "...excited about the next stage" etc. That's just pointless and frankly, no one cares what you do after shutting down. It's your product that people care about.

Telling users the why and what goes a long way in establishing trust. Don't keep them in the dark because you are too scared to own up to your mistakes. Communication and transparency around the whole process is essential (especially if you subscribe to the "privacy and freedom" ideology).

Show empathy and face the backlash

When MYKI shut down a few years back, it was one of the most frustrating times for me. No other alternative was satisfactory. I tried Bitwarden, 1Password, LastPass, and all sorts of password managers but none of those came even close (I eventually migrated to Keepass).

Migrating from one tool to another is not a trivial task so show empathy and understand your users. If they are angry, their anger is genuine. If they are frustrated, their frustration is genuine. Don't leave them hanging and helpless. It's not the users' fault that you have to shut down so don't walk all over them.

Running a startup is not easy, and the more users you have the worse the backlash will be when you shutdown but facing the backlash head-on is part of this whole business. You cannot run away so just be as honest, as transparent, and as open as possible.

Good faith gestures

All startups shutting down should open source all their code. Period.

It benefits no one when a startup just blinks out of existence. There are so many examples of really good and useful products that solved real, actual problems but had to close down. It would be phenomenal if all those services published their code before going dark so someone else could take up the mantle.

Any startup genuine about its claims of "mutual benefit" should open source all the code under a permissible license for the sake of public good. If that cannot be done then mass refunds should be issued for all paying customers. It shouldn't be an option given to users but a proactive action done on the part of the startup. If your users trusted you enough to purchase your subscription, the least you can do is a issue a refund when you shut down.

Of course, none of this is enough to placate a frustrated user but it goes a long way in showing that you really did try your best. Otherwise, it just looks like you are swindling people's time and money.

Give your users enough time to migrate

Not all users can migrate in a blink. Many users don't even have the mental capacity to think about migration. You are not only responsible for letting users export their data but also for helping them find and migrate to good trusted alternatives. After all, they trusted you with their time, money, and data so you should return the same courtesy.

How much time is enough time is different for each product but I think establishing an extra margin of a year or two really helps dispel all the panic around the shutdown. That sounds like a lot but a few weeks or months is not enough time to migrate. All it does is create panic while users scramble to find a good enough alternative.

Final thoughts

I wish Skiff didn't shutdown. Just a few weeks back I was exploring it in hopes of migrating our business email to Skiff. They created something really great, and it's unfortunate that they have to discontinue.

If any of the founders from Skiff Privacy is reading this post, I encourage you to open source the backend as well as everything else around Skiff. That'll leave a legacy behind instead of the bad feelings users have currently.

That's it from me. Thank you for reading. If you have any questions, feel free to reach out via email, or on Twitter/X.

Read on to find out everything that's new in v2.6.0 and what we will be working on in the coming months.

Custom themes

Imagine opening Notesnook and wanting it to look a certain way. Maybe you'd like the left navigation bar to be black with green text on it, maybe your theme is beige and you want everything too look just right. Whatever the case, now you can do just that and more.

Before you cry out in horror imagining how much work something like that would require, I want to give you a "sneak peak" at the potential our theming engine has.

Normally, if you want to change how something looks you'd be required to have the arcane knowledge of CSS. That's how Obsidian's does it (and there's nothing wrong with that). However, there's the obvious problem of not everyone knowing how to work around in CSS.

That is why we built Notesnook's theming engine to be as simple as possible. If you know colors, you know how to build a theme for Notesnook. For example, the above Monokai theme is just a 5 KB JSON file containing around 145 lines in total.

The best part of all this is that it "just works" on all platforms. A single theme can be used, as is, across mobile, web, desktop, and the web clipper. How cool is that!

The Theme Builder

But JSON is also quite complex too, you might say, and you'd be right. That's why we created the Theme Builder. It's a 100% GUI way of building themes for Notesnook. Here's a quick sneak peak.

The best thing about the Theme Builder is that it is 100% live & real-time. You don't have to reload the app in order to see the changes you made — they are reflected as soon as you make them.

You can try it out at https://theme-builder.notesnook.com. We also wrote a guide on how to use the Theme Builder, which you can refer to here.

What about the old accent colors?

Unfortunately, we had to ditch the old accent colors in favor of themes. But don't worry, we will be adding back all the accent colors as themes very soon.

Are themes going to be pro?

Currently, there's no restriction in place so anyone can use any theme they like but eventually, we will add Pro themes that can only be used

How to create your own theme?

We have added in-depth documentation and help regarding how to create, preview & test your own theme in your help. You can check it out here.

Improved copy/pasting

A note taking app is nothing if it cannot preserve the formatting of whatever comes into or goes out of it. Previously, copying things from Notesnook would completely destroy its formatting, adding empty lines where there should be none, converting single spaced paragraphs into double spaced ones etc. If you have been a Notesnook user, you already now how frustrating that is.

Well, good news for you then! In this release, we have made a bunch of fixes to the way our copy/pasting works:

1. Copying a single list item no longer copies it as a list but as a paragraph
2. Copying multiple list items no longer add empty lines around each list item
3. Copying content to & from Notesnook now follows the Double spaced paragraph setting.

RTL improvements

If you do a lot of writing in RTL languages (Urdu, Arabic etc.), this release will be your favorite for sure! Why do I say that? Well, take a look yourself:

1. You now only need to set the text direction once, and everything else just follows it automatically. Previously, you'd have to constantly align different nodes to the right which was cumbersome and annoying.
2. The title now automatically changes the text direction to RTL if it detects RTL text. How cool is that?
3. RTL notes in the notes list will now automatically be aligned right-to-left.

Syntax highlighting and rendered Math in exports

If you do lots of printing or exporting, good news for you! Notesnook will now automatically syntax highlight all the code blocks and render all the math as LaTeX. Here's how it looks:

Keyboard shortcuts in menus

While keyboard shortcuts are still not implemented, we are slowly preparing the UI for the big change. Starting from this release, you'll now see the keyboard shorcuts in a few places around the editor.

Bug fixes & minor improvements

And of course, what's a new major release without a bunch of bug fixes and QoL improvements? Here's the full list of "worthy" bugs that we fixed:

1. Fixed issue where entering Monograph password closed the Publish dialog
2. Copy button on code blocks will no longer be disabled in readonly mode
3. Fixed color picker height when the editor toolbar is at the bottom
4. Pressing the Tab key in the Title will now move the focus to the editor
5. Respect empty paragraph lines when printing or exporting to PDF/HTML
6. Don't show "Failed to unlock vault" error when exporting a single unlocked note
7. All input fields now follow the current color scheme
8. Prevent unintentional saving when opening a note
9. Respect text direction when adding blocks like heading, lists etc.
10. Fix "Dynamic module import is disabled" error when logging in on Firefox ESR & Tor Browser
11. Prevent scroll jump & selection loss when toggling focus mode
12. Fixed issue where caret would keep jumping to the end when making edits in the sticky editor title
13. Overhaul the logger implementation to be less IO intensive
14. Fix spell checker on desktop app
15. Fixed issue where embeds would not render in readonly mode
16. Format time & date on reminders according to the format specified in the Settings
17. Bring app to front if user tries to start a new instance of Notesnook
18. Show progress when restoring large encrypted backups

What's next?

A few urgent things on the schedule are:

1. Fix how we store & sync tags, colors, and settings.
2. Improve performance of image attachments.
3. Roll out first iteration of the new search engine.
4. Explore note linking.

The only reason its 2.0 and not 1.8 is because there are a few significant improvements we have made that make a major release worthwhile. Read on to find out!

Evernote web clips

Notesnook Importer has one of the best (if not the best) support for importing from Evernote. We have handwritten the ENML parser to be both fast & support everything attribute under the sun. In our own tests, importing a 2 GB .ENEX file, containing over 2000 notes, is a breeze.

With this release, we are adding full support for importing your saved web clips from Evernote directly into Notesnook with 100% compatibility. We have added support for the following types of web clips:

1. Full page
2. Simplified article
3. Article
4. Screenshot
5. Bookmark

Obsidian Importer

While we have supported importing from Markdown since v1.0 of the importer, we have never officially supported the Obsidian Flavored Markdown until now. With this release, you can easily and quickly import all your Obsidian Markdown files directly into Notesnook with close to 100% compatibility.

Here's a list of everything we support from Obsidian aside from the usual markdown:

1. File embeds (e.g. ![[path/to/file.ext]])
2. Comments (e.g. This is a %%comment%%)
3. Frontmatter/Metadata (used to extract tags, title etc.)

Note: custom markdown syntax included by community or other plugins in Obsidian is not (yet) supported.

Markdown improvements

With this release, we have overhauled our old markdown parser, marked, and replaced it with remark. It's support for extensions is truly remarkable allowing us to quickly add support for various formats and Markdown syntaxes. Here's a list of everything that should now officially work:

1. Subscript and superscript (H~2~O and 19^th^)
2. Math block ($$some math$$)
3. Highlights (==highlighted==)

Softbreaks

We have fixed the softbreak collapsing to correctly render softbreaks in lines. Here's a quick before and after.

For this markdown:

Paragraphs like this that can span multiple lines
for more awesomeness.

Before:

Paragraphs like this that can span multiple linesfor more awesomeness.

After:

Paragraphs like this that can span multiple lines for more awesomeness.

Single spacing vs. double spacing

Previously, our markdown importer was defaulting to double spaced paragraphs. While this worked for some, it annoyed quite a big percentage of users. With this release, the importer is no longer opinionated on this. It'll follow whatever you have configured on Notesnook during imports.

Blank lines in code blocks

Blanks lines now get properly rendered in code blocks instead of getting removed during imports.

Aside from that, you can expect the markdown importer to produce much more correct output with fewer unexpected issues.

Improved documentation

We also spent some time improving the documentation and tutorials on how to import from each different app. There's now a step-by-step import guide for Obsidian & plain text files.

Aside from that, each import guide now also has a Supported formats section at the end which lists an up to date version of everything we currently support (and don't support) from that app. This will give you a better idea of what kind of work awaits you after importing (or whether to import or not yet).

Links to step-by-step import guide

You will now see a link to a step-by-step guide for each note app you want to import from directly on the Importer:

Ending thoughts

Notesnook Importer supports a lot of ways to bring your notes from other apps into Notesnook. In fact, Notesnook is the only note taking app that supports this many apps to import from. That is not an easy feat i.e., there are bound to be broken importers and issues during importing.

However, that has not prevented us from supporting even more apps so far. As for right now, we are working on 3 new importers:

1. Upnote
2. OneNote (from a OneNote backup file; no more logging in etc.)
3. Nimbus note

I'll post an update here once they are ready.

In October 2022 when we went open source, our beast of choice for the seemingly complicated task of monorepo management was Lerna (and Nx). We had to make a few concessions, learn some new patterns, give up old habits, but it all worked out...eventually.

What we had not foreseen was the impact it would have on our productivity. The only reason we decided to use Lerna was for its package management in a monorepo structure. At the time it solved the problem of, "How do I install X subproject in Y?" but every day we had to face some new problem requiring us to either work around Lerna or deal with it by changing something else. A few examples:

1. It is not a trivial task to use Lerna with flatpak-builder.
2. Sometimes Lerna would refuse to update the package lockfiles. The solution? Delete all the node_modules directories and run lerna bootstrap.
3. CI would fail because Lerna automatically switched to npm ci which requires the lockfile & package.json to correlate. The solution? Force a lockfile update, either by clearing all the node_modules or deleting the lockfiles.
4. Switching git branches and bootstrapping again was a nightmare. Sometimes dependencies wouldn't install or Lerna would install old versions due to outdated package lockfiles. The solution? Delete node_modules directory and run lerna bootstrap.
5. There's no way to do npm i in a subproject when you are using Lerna. You have to use lerna add.
6. lerna add doesn't work well with git: or file: packages requiring you to unnecessarily publish everything to NPM.
7. There's no lerna remove so the only way to uninstall a package is by removing it from the package.json, but most of the time that also requires deleting the whole node_modules directory.
8. Lerna takes 100 MB after install.

Lerna has forced us to download gigabytes over and over again. Okay, I admit, it's not that bad - there's caching and all but still I shouldn't have to clear out node_modules repeatedly just to get package management to work.

I am aware that Lerna is not only meant to be used for package management. In fact, even Lerna had to acknowledge their broken package management, calling it "Legacy", and encourage users to use the package managers' Workspaces feature instead. From v7 onwards, Lerna no longer provides its users with the ability to bootstrap or install a package through it.

It's good advice when you are starting a new project, but in an old project that's "working" there's no time to deal with all the issues that come with using Workspaces:

1. npm workspaces defaults to hoisting all the packages in a workspace to the root node_modules directory. I have found no way to turn it off. Hoisting creates a boatload of issues which require more tools to fix, which create a new set of issues, ad infinitum.
2. yarn workspaces supports turning off hoisting and was almost perfect, but it failed to install some native Node.js dependencies. I had no time to look into why it broke.
3. pnpm almost worked, but it isn't supported by flatpak-builder and also requires some nasty hacks to work with Metro Bundler — the de facto bundler for React Native projects.
4. bun install doesn't work on Windows.

We needed a tried and tested solution that "just worked". Our requirements:

1. It should be possible to do npm i or yarn add or pnpm install wherever we want.
2. Bootstrapping should be quick and responsive (i.e., we shouldn't have to see dead progress bars for ages).
3. No learning curve. Everything should be obvious, boring, and simple.
4. No hoisting. All packages should be placed in each project's node_modules directory. This is widely supported and very stable.
5. flatpak-builder support.
6. Small & hackable, requiring minimum maintenance.
7. Easy to bootstrap specific scopes (e.g. only bootstrap the desktop app).
8. Reliable cross-platform support.
9. Zero config files.
10. It shouldn't be 100mb in size.

You must be thinking (with a groan), "Here comes another monorepo management tool". You'd be 100% wrong.

Working on Notesnook, I have realized no one wants a simple solution. A 10-page-long feature list is preferred over something that does one thing and does it well — the Unix Philosophy, so to say.

No. I had no time to deal with a new tool that'd break in 100 different ways. I wanted a solution that worked with our existing codebase without too many changes, so I did what I should have done from the beginning:

I wrote a script.

144 lines (including blank lines & comments) and only 3 package dependencies (yargs, fast-glob & listr) for nicer DX, doing only one thing: bootstrapping. Here's how it looks:

What's the benefit? Why go to all this effort? Did it really pay off?

1. Our CI run time decreased by 1 minute per job across the board. That sounds little, but it all adds up when that job runs 60 times a day.
2. We have yet to delete the node_modules directory even once, and it has been a month, almost.
3. We can do npm i anywhere we want without breaking anything.
4. The perception of speed when running npm run bootstrap makes us feel 10x faster.
5. Lockfiles never get outdated or suddenly updated for no reason.
6. It's just npm i doing all the work, so everything works without changes.

Best of all, there's not been one occasion where any of us has screamed with frustration over Lerna getting stuck.

Life is simple again.

Bootstrapping a monorepo is a surprisingly simple task consisting of only 2 steps:

1. Find all the locally linked dependencies of all the subprojects recursively.
2. Go into each linked dependency and run npm i or yarn install.

A bash wizard could probably do this in 3 lines. I won't put here all the code because it's too obvious to warrant a discussion, but you can have a look at the code here.

Conclusion

This is our story. Don't take it as a pitch against using Lerna or any other tool. Lerna serves many other usecases which I haven't (yet) found a need for.

In the end, use whatever works best for you and when that breaks look for the simplest solution instead of the "industry solution" or "trends". After all, the only thing a tool is meant to do is save your time.

This marks a new milestone on our journey to become the best private note taking tool out there. We have already been listed on PrivacyTools.io — another great resource for finding great tools that put your privacy first.

Privacy Guides

Privacy Guides is an amazing place to find some real gems in the privacy tools space. That and their vibrant community makes Privacy Guides one of the best places to go if you are looking to protect your privacy online.

What's next?

We'd love to be on every list of privacy respecting productivity tools but unfortunately, not everyone thinks the same. Let's see what the future holds.

If you are a member/owner of such a list, I'd love to chat!

Attachment previews

You can now preview PDFs & all kinds of images directly inside Notesnook. No need for long & tedious process of downloading & opening the attachments in a separate application. Here's a glimpse of how it looks:

Other types of attachments

Our plan is to implement the most useful kind of preview for each attachment type. For example, videos & audios are best previewed inlined. They don't need to be opened in a separate pane like PDFs. Similarly, other documents like text & markdown files would work best in a separate pane.

Eventually, we will allow users to add support for different file types using extensions. It isn't practical or feasible to support every single format officially.

New attachment manager

We have redesigned the attachment manager to include quick filters for different types of files making it very easy to manage your attachments. We have also improved support for performing bulk actions like deleting, downloading & rechecking the attachments.

Note: Orphaned attachments are those attachments that don't belong to any note.

Web clipper on Chrome Web Store

Thanks to @Aaron from our Discord community for donating a Chrome Web Store account and making it possible for the Notesnook Web Clipper to be published on the Chrome Web Store.

Ever since we release the Notesnook Web Clipper, this has been one of our biggest drawbacks. Our goal with Notesnook has always been to make it easier for people to use private & safe software. Unfortunately, until today it was a huge hassle for anyone wanting to use our Chrome extension. No anymore!

I am really excited to announce that Notesnook Web Clipper is now officially available from the Chrome Web Store! Go check it out and don't forget to leave a review.

Notesnook on F-Droid

Notesnook was already available on F-Droid via the IzzyOnDroid repository (which I believe almost everyone includes, anyway). However, the important thing about getting approved on F-Droid is satisfying their requirements. No Google libraries whatsoever, no lock-in, reproducible builds, fully open source etc. This is why it's a huge thing for an app to get approved on F-Droid.

It took us several months of back and forth with the wonderful people over at F-Droid to finally get Notesnook approved on F-Droid. We faced issues such as failing builds due to missing libraries, ABI version problems, build minutes running out on GitLab and a few other issues. The result? You can now easily install Notesnook from F-droid without requiring usage of any 3rd party repositories.

Note: The F-droid version of Notesnook is slightly different than the one available on GitHub.

Notesnook Importer

There were 2 very critical bugs that were fixed:

1. Images and attachments linked in Markdown notes were getting ignored.
2. Empty Google Keep notes with image attachments wouldn't import.

Both of these issues have been fixed in v1.7.7 of the Importer. Go try it here.

An important thing to keep in mind is that the Importer doesn't distinguish between an attachment and an internal link so any link that resolves to a local file will get imported as an attachment. For example, [this is an internal link](important-link.md) will get imported as an attachment named important-link.md.

Community achievments

1. We crossed 6k stars on our GitHub repo! (Go star the repo)
2. We crossed 5k followers on our Twitter account. (Follow us)
3. Over 400 students & teachers have benefited from our Education plan. (Apply now)
4. Over 900 people visit our website every day (an increase from 700).

Thank you for supporting us!

What the future holds

In the next months, our focus will be on releasing the following features (no promises!):

1. Backup & restore attachments
2. Default notebook/topic/tag
3. Changing default note title
4. Changing default date format
5. Support for sharing files/images to Notesnook
6. Custom themes
7. Note linking
8. Self hosting

If the above sounds interesting to you, I recommend following us on Twitter where we regularly post updates about the app.

On the other hand, if a proprietary software is not held up to the same standards. It can get away with tracking its users, usually at the spyware level, without any complaints. The problem therefore is: should there be telemetry in FOSS?

Surveys and Polls

Anyone who has built a software knows how insignificant the results of a survey/poll can be. Only a minority of a minority of users would take the time to fill them out which quickly puts them in the useless category. Even if you are Elon Musk, with 122 million followers, polls are not a great way to get user opinion because the bigger the sample size, the bigger the gap between majority & minority.

Which brings us to...

Opt-out telemetry

We see this practice in a lot of FOSS/proprietary software. There is usually some popup like "Help us improve XYZ by sending completely anonymous usage data." which is already filled out. The users who take the time to read carefully might uncheck that box but most people out there skip ahead and use the app.

That's the problem.

The user hasn't actually consented to being tracked. They might not even know they are being tracked and they certainly don't know how to turn it off. Its like with the Cookie consent popups you see these days thanks to GDPR; they are so annoying that most of us just click allow to get rid of it because any other button will take you to this "Settings" page to check/uncheck a bunch of nonsense data categories, half of which can't even be unchecked.

The bright side of this story is that companies get a lot of data as a consequence and if its not FOSS, only Allah knows what data that actually is. So opt-out is clearly bad but what about opt-in?

Opt-in telemetry

No one actually does this because its too good to be true and too useless to make any sense. Just kidding.

Opt-in telemetry is fully consent-based and I have rarely seen an implementation of it that makes me want to opt-in. A dead checkbox saying, "Help us improve XYZ" doesn't work because as mentioned above, users just move on.

Ethically speaking, there can be no better balance of collecting usage data. Realistically speaking, there's no worse option because, as is the case with surveys, the sample size is just too small to be actionable.

Wrong data is worse than no data.

Suppose only 1% of your users opt-in to telemetry (which is not unrealistic) and after some internal debate about removing some feature X, you decide to just add a telemetry endpoint to see how many users are actually using it. See where this is going?

Out of those 1% users about 0.9% users regularly use feature X. So far so good. You run to your team and tell them about your recent discovery only to be pointed out, "what about the other 99% users?". At this point usually companies either give up or make telemetry opt-out.

What about zero telemetry?

Zero telemetry

This is every privacy enthusiast's pipe dream. Unfortunately, its only being practically used in side projects who rarely anyone cares about. But putting that aside, what's the point of zero telemetry?

Zero telemetry means zero visibility into what's going on in the app. Who is using which feature? What percentage of users are annoyed by this popup? Which is exactly what privacy entails. We see this in VPNs under the "no logs" policy (not sure how true that is).

So what should a company do?

What about Notesnook?

What about it? We recently went "opt-in" from "opt-out" due to privacy reasons. In all honesty, I wanted to go the "zero telemetry" route because the data we collect has very little practical use (aside from encouragement). So why "opt-in" then?

I think this is a safe "middle ground" in the world of telemetry. It won't put us at a disadvantage when we do have important data we want to collect from users & and it also won't allow us to be privacy invasive. The above points regarding "opt-in telemetry" hold true for Notesnook as well because for now we only have that dead checkbox. But that is going to change very soon (more on this in a later blog post).

What we collect?

I think it is very important for users to know what & when data is being collected. Here's a (small) list of events that trigger telemetry:

You might be wondering what else gets sent with all of that. We use Umami analytics for telemetry but instead of their tracker script we have an in-house script to control exactly the amount of data to collect. The main data collection function looks something like this:

async function collect(event: PageView | Event) {
  const {
    screen: { width, height },
    navigator: { language },
    location: { hostname, pathname, search }
  } = window;

  const screen = `${width}x${height}`;
  const currentUrl =
    (event.type === 'pageview' && event.url) || `${pathname}${search}`;

  const body = {
    payload: {
      website: `the-website-id`,
      hostname,
      screen,
      language,
      url: currentUrl,
      ...event
    },
    type: event.type
  };

  try {
    await fetch(baseUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json'
      },
      body: JSON.stringify(body),
      keepalive: true
    });
  } catch (e) {
    console.error(e);
  }
}

You can read more about Umami at their website.

Conclusion

There's no conclusion, unfortunately. It's all a trade-off between privacy & convenience.

What Notesnook offers to students

Notesnook poses itself as a complete note taking solution & tries to stay out of your where while you do your work. I know that sounds like gibberish but give it a try. We have done our very best to make the UX as smooth as possible:

1. There are no new concepts to learn — it's just note taking.
2. There are multiple ways to organize your notes.
3. We offer a single no-nonsense editor that'll fit your every need.
4. To top that all off you can share your notes using Monographs to anyone in the world (and even protect them with a password).
5. You can attach 100% encrypted attachments by default so all your PDFs, slides, videos & documents are safe.
6. Since Notesnook works on every device with 100% feature parity, you don't have to worry about always carrying a laptop with you. Just pull up the Notesnook app on your phone and start editing.
7. Notesnook also offers built-in exports in PDF, HTML & Markdown (other formats are in the works).

With that said, there are some limitations that we are working on:

1. There is no drawing/handwriting support.
2. Things like PDFs & documents needed to be downloaded before viewing.
3. Attachments cannot be directly shared.

If any of the above will affect your workflow, I recommend waiting until we sort these out before fully migrating. You can keep an eye on our roadmap & follow us on Twitter to know when these features land.

Why not free?

I am aware how some products out there give out a completely free option to educators & students and while we aspire towards that it is not realistic for a startup at our scale. We are just starting out and need all the help we can get — this includes subscriptions, documentation, support etc. But we didn't want to use that as an excuse which is why we are offering Notesnook Pro to educators & students at our lowest possible price i.e. 9.99 USD/yr.

Closing note

With this new plan I am hoping more students & teachers will be encouraged to adopt private alternatives. Privacy is a global issue & each of us has to fight against the Information Mafia that wants to spy on us and use our data for their own nefarious purposes. Any step in that direction is a step in the right direction.

If you haven't used or heard of MYKI, here's what it offered in its free tier:

1. Unlimited passwords
2. Unlimited devices
3. Unlimited 2FA keys
4. Unlimited secure notes
5. Unlimited credit cards

A very appealing offer for most users. Their intended customers were teams and businesses but turn out there are not that many of them. Most teams either don't want a password manager ("not a problem" scenario) or they are already using a different one (LastPass etc.).

The problem with MYKI was simple: they didn't want to charge the majority of their users to encourage higher signups, more growth, etc. I was also one of their free users who refused to upgrade because I never felt any need to. I could store unlimited passwords & unlimited 2FA keys, and have them synced across unlimited devices. Why would I upgrade when there were 0 extra features I needed? That was also one of the reasons it was so hard to migrate when they did eventually kill off MYKI — no other password manager, including Bitwarden, offered the breadth of features MYKI did in their free tier.

Note:

If you are a privacy-minded individual who also takes notes, Notesnook recently open sourced all their clients with plans to open source a self-hostable sync server soon.

I'd appreciate that a lot if you can help us by starring the GitHub repo and/or trying out Notesnook.

What does this have to do with Bitwarden?

Let me explain.

Until now the only source of revenue behind Bitwarden were their users (or teams/businesses). Unlike MYKI they do not include 2FA in the free tier but everything else was free (very appealing for new users). What did they charge though? $10/yr:

That is not a boatload of money. Why? Because they know that no one would pay otherwise. Password managers don't have a lot of innovation left in them and the only saving grace behind Bitwarden is its open-source nature. Password managers are a fire-and-forget kind of software. You never even open a password manager except to unlock it. The only real use case of a password manager is to, well, manage your passwords. That's it.

Bitwarden is the only password manager recommended by the majority of the security community to layman users due to its simplicity & security. A wonderful product, to be sure.

But the problem with their approach would be apparent to any business-minded person: there is not a lot of selling potential in a password manager. After a point, you are forced to look towards the B2B market (via MYKI Teams or Bitwarden Business plans) but that is clearly not enough.

The evidence lies in the recent move by Bitwarden to raise a $100M seed fund to shift their focus towards other opportunities (authentication). Bitwarden succeeded. It got popular and hit its peak potential (aside from acquiring more users).

What does the $100M seed funding mean for Bitwarden?

Any kind of seed funding is focused on 2 primary things:

1. The potential in the team/product to succeed.
2. The need to generate a lot of revenue.

VC-backed startups are intensely revenue-focused. They no longer have the option to say no to business propositions that'd be harmful to the freeloaders at the cost of paywall-ing content, cutting features from the free plan, etc. This makes perfect business sense. You can't make money by selling free food.

Why would Bitwarden be any different? $100M is a lot of money. The first thing that'll happen is either the team's focus will move towards a lot of different things or they'll build things around Bitwarden turning it into a complicated mess no one wants to use (unlikely).

As with any VC-backed startup, Bitwarden will have a limited time to turn a significant profit by whatever means possible. Investors don't like to lose money. And let me tell you one thing. $100M is a lot of money and once you see & handle that kind of money, it's hard to look back. I wouldn't be surprised if after the first few years of trying, Bitwarden the password manager gets discontinued.

The impact of this decision will reverberate over a few months. If the core team starts a different project, you'll see reduced activity in their GitHub repository — the death of Bitwarden is near.

But Bitwarden is open source!

It won't become another MYKI, for sure (unless they close source their code (highly unlikely)) but won't it impact you, as a user, when suddenly the perfect product becomes buggy due to negligence? I am not sure what'll happen here. Maybe the community will take up the project, maybe another company will acquire Bitwarden. In any case, Bitwarden's future is quite shaky.

You can always stay on a certain version, never upgrade, self host and live off of that but how feasible is that for the average Joe? The open source nature of Bitwarden makes this sort of thing more bearable but it'll still be a huge hit.

What can you do?

When MYKI got acquired moving my passwords was extremely hard. There are not many open source (or closed source) alternatives that offer the same set of features as Bitwarden. I eventually settled with Keepass which isn't ideal either (manual sync, old UI, broken clients) but I am quite sure it isn't going anywhere (it's community-run, multiple clients, no centralization, no servers, just a DB version that can't be killed off).

Does this recent news mean Bitwarden is dying off? No. All this is conjecture but based on a lot of previous evidence. Seed funding is extremely bad for the consumer market (unless you are Netflix). Should you migrate to another password manager? Too soon to say anything. You're probably safe for a few years. It is only wise to prepare beforehand, however, in case something of this kind does happen. This includes researching & trying out alternatives or,if you are like me, building your own.

Closing thoughts

I honestly hope this doesn't happen and that Bitwarden stays true to their original purpose but it appears highly unlikely. Moves like these should make you cautious of what can happen (exactly what this blog aims to do).

A matter of trust

When I look at the private note-taking apps space, there's only one name: Standard Notes. Its trustworthiness is undeniable because it is open source regardless of how good or bad it is. On top of that, every respectable privacy-oriented software is also open source. A clear indication that we are the odd one out.

So why now? The main reason for the delay was inexperience & lack of resources. Notesnook has been a 3-man project for a year & we could do only so much. Maintaining an open source project requires a lot of energy. Energy we could not spare.

Along with that, we had very little idea about how important open sourcing is. Over time and feedback from our users, we realized the opportunity we were missing. Many people reached out to us concerned about their privacy. More often than not, the conversation went something like this:

Hi, I love what you guys are doing with Notesnook, but I cannot migrate all my notes because it is not open source. Have you guys thought about open sourcing yet?

Users' feedback has been the primary motive behind Notesnook's growth (the new editor, fixing performance issues, making sync reliable, etc.). It was clear after a time that a lot of users were hesitating to join Notesnook because we weren't open source.

And the community's response speaks for itself after we broke the news last month. We received 100+ stars on our GitHub repo, 700+ followers on Twitter, and a lot of people came back after hearing that we are going open source. All these are validation enough that this is a good idea.

Community

Open source is nothing without its community of contributors, developers & everyone else working together to make something great. We'd be crazy to not let Notesnook benefit from that.

And to be honest, Notesnook would not be here today without the efforts of the open source community; starting from the lowest layer (Linux) to the highest (React). We owe this contribution to OSS.

(A)GPLv3

For this very reason, we have decided to go with an (A)GPLv3 license. I wanted a less permissive license for Notesnook (BSL or something) but this wonderful article by Drew DeVault changed my mind. Freedom is a part of open source & we do not want to restrict you in any way.

DCO vs. CLA

I had no idea what Developer Certificate Of Origin was until I heard about what happened with Redis Labs & ElasticSearch. I have signed a few CLAs myself (React Native) not knowing what they implied.

Re-licensing our contributors' hard work under a proprietary license would break all levels of trust. Even if that is legal, I cannot allow Notesnook to allow that. Everyone deserves to be acknowledged for their contributions which is why we are going with DCO instead. I am hopeful that this will create a safe environment for everyone & encourage more contributions.

If you have a minute, I'd appreciate if you can star our GitHub repo.

Transparency

Building Notesnook behind closed doors gives us the safety to be lazy & make mistakes. An easy thing to do since no one can point them out. I know for a fact that there are some obvious flaws in Notesnook invisible to my eyes. No matter what I do I cannot completely eliminate that. Open source gets around this by being transparent. What is transparency?

The fact that anyone can scrutinize my code & point out the mistakes. At first this is anxiety-inducing but from a different perspective it is also vital for Notesnook to be bulletproof. 1 person cannot fix the bugs a 100 people can.

Independence

I was a user of the MYKI password manager for the last couple of years. This year when they got acquired I was forced to migrate — not something I enjoy. I liked how MYKI made managing passwords so simple but they shut down their servers and I could do nothing.

If MYKI had been open source this whole scenario would have been so much different. I'd have self-hosted it and gone on with my life.

That's what I want Notesnook to be. A piece of software that'll live on even if we decide to shut it down. Independent from decisions of a single party.

What will be open sourced?

Here's a list of all the different components of Notesnook that'll be open-sourced:

1. Web, desktop & mobile clients
2. Shared core
3. Editor & extensions
4. Sync server

Most of these will be in a monorepo for seamless integration. The sync server get its own repo, though.

How can you contribute?

In the first few weeks, we'll be focusing on improving repository's health. This includes:

1. Writing lots & lots of tests
2. Improving documentation
3. Refactoring the client apps to share as much logic as possible

We won't be accepting any feature pull requests until the repository is in a good enough health. Still, you can help out in various ways:

1. Bug fixes (& bug reports)
2. Writing documentation
3. Taking part in refactoring discussions
4. Writing tests (if you are familiar with Playwright, Jest, etc.)

Ending thoughts

All in all, I am super excited about making Notesnook open source. If it were possible I'd open source it immediately but I want to do it right to avoid any regrets later. This is by no means a sole mission and you can take part in the conversation without any hesitation on GitHub.

Why not email?

Before we can get to why email still makes sense we need to first discuss how email can be abused to put things in perspective.

1. User identification

If you only ever sign up for a single account in the entirety of your digital lifespan, you'd be safe. However, that's not the case for most users. As long as you use a single email address to sign up for multiple services (doesn't matter how separate they are), your email address can become a point of identification.

This is the primary danger to your privacy.

User identification can be used to build a profile on you which can then be sold or used for ad targeting.

2. Spam

Every year a lot of people fall for email spam which primarily happens due to data leaks by services either intentionally or accidentally. If you never give someone your email nobody can reach out to you & hence you remain safe.

A lot of spammers these days mine user data using different identifiers including email address & phone number to build a profile. This profile is then used to compose a very authentic looking spam email which anyone can fall for.

Anecdote

A few months ago we received an email from Apple requesting more information to process our monthly payments. The email listed everything including our company name, phone number, full name etc. and hence looked extremely authentic. Even the email address domain was apple.com.

So why email then?

The above 2 points should be enough for anyone to stop signing up using their email. However, it is important to get a clear picture of why all the services including Notesnook depend on email.

1. Preventing account spam & bot accounts

As a service provider blocking bot accounts & preventing abuse is necessary to keep everything running smoothly. Email address offers one way to do that without worsening the UX too much.

Email signups require an additional verification step during account creation which discourages bulk account creation.

This is in no way bulletproof but requiring an email can significantly slow the attacker down. As opposed to a username which can easily be randomized & automated.

2. Memorable & accessible

Email has become like a phone number. (In fact, phone number & email pose very similar risks to privacy due to their widespread adoption.) Everyone with Internet access has an email account which makes it tremendously accessible.

People still forget their email but generally speaking it is much harder to remember a different username for each service. This is exactly why a lot of users stick to a single username. However, usernames can easily be hijacked.

Since each email address is inherently unique it's not a trivial task to hijack it without hijacking the whole email account first. This makes email addresses irreplaceable & easy to use.

3. Account recovery

The first thing users forget after signing up is their password. At this moment no private notes app except Notesnook offers account recovery which is very frustrating for a lot of users. The fault obviously lies on the user side: they should use a password manager or remember the password well but this is already a losing argument. As a service it is our job to provide rescue when things go wrong, not the user's.

The fact that privacy always comes at some cost to convenience is the very reason most people hesitate when it comes to protecting their privacy. In short, account recovery is mandatory regardless of whether a service is E2EE or not.

Notesnook offers 3 ways to recover access to your account:

1. Using a recovery key
2. Using a backup
3. Resetting everything & starting from scratch

The primary way account recovery works is:

1. You enter your email address
2. The service provider sends you an email with a link or a code
3. You click on the link in the email to start the account recovery process

Without an email address it becomes impossible to verify the ownership of an account.

4. Reachable

Server breaches are real. Data gets compromised or some other critical issue can happen. Having a way to reach out to our users in a reliable way is vital to ensuring their safety and email is the way of communicating with our users.

Aside from email, Notesnook also has an in-app announcement system for notifying users about critical issues & ways to avoid them. However, not everyone always has Notesnook open in which case they can miss an important announcement.

In addition to this, some services including Notesnook use email to regularly update about the product's progress. All these non-critical emails are optional, of course but they provide a really great way to keep the user in the loop with minimal effort on the user's side.

Sharing your email safely

The first instinct after reading this might be to ditch email entirely. It's an old technology full of holes patched over & over again. Try as we might, however, we have to live with email.

Since almost all services have a way to sign up via email, it's necessary to know how to anonymize yourself without depending on any single service. It's inevitable that at least one service out there will be careless with your personal data. Trusting the vendor to do all the heavy-lifting will leave your security full of holes.

1. Anonymize your email

It's cool to have a recognizable email address (e.g. <lastname>.<firstname>@<domain>) but it's also the first thing connecting the email address to you. The first step should always be to randomize your email address in such a way that it cannot be used to know who's behind it just by reading it.

Instead of using your full name or initials in your email, you can adopt a fake persona and use that.

Doing the above can be quite inconvenient if your email is already connected everywhere. For this I recommend slow migration.

2. Email aliases

Email aliases cloak your real email offering complete anonymity while sharing the same email address. A sender sends an email using the alias but it arrives in your real inbox. Simple & convenient.

An email alias acts as a proxy.

Since you can create unlimited aliases for a single email address, this can be an easy way to dissociate one account from another.

You can use any of these services to set up email aliasing:

1. SimpleLogin
2. AnonDaddy
3. Firefox Relay

Email aliasing can also help you narrow down potential culprits in case you start receiving spam emails. This obviously requires you to use a unique email alias for each service or each group of services which might not always be convenient.

3. Disposable emails

I generally don't recommend using disposable emails (unless you are creating a disposable account as well) due a variety of reasons. However, they can be a good way to sign up without exposing your real email address.

Do note that disposable emails are transitory i.e., you can lose access to an email address at the worst possible moment and there's no way to get it back. This makes disposable email a risky way to ensure anonymity.

The Future of Notesnook & Email

At this point in time (July 30, 2022 PKT UTC+5) if Notesnook's database is compromised the only data at risk is users' email addresses. While we recommend each user to take the necessary steps to anonymize their emails (as listed above), it is also mandatory as a private note taking app to improve our security.

These are some of the practical steps Notesnook is going to take to prevent potential leakage of users' email addresses.

1. Ephemeral email address storage by default

Most uses of email listed above (account recovery, spam prevention etc.) do not require storing the email at all. However, it is essential to verify that the entered email address is the right one. For this we can store a one-way hashed version of an email address (instead of plaintext) for the purpose of verification.

Whenever the user starts a process that requires email verification, the client app can ask the user for their email. This is already being done for some processes (e.g. account recovery, account creation, log in etc.).

All this, however, requires trust since the emails will still be transmitted as plain text and it'll be up to us to decide whether to store them or not.

2. Opt-in email address persistence

Storing emails ephemerally offers greater security but it prevents us from reaching out to the user in case of a critical issue. Currently, this is not a problem because all email addresses are stored in the database as plain text & can be easily retrieved.

To solve this problem, we will give the user the choice of whether they want their email stored for external communication or not. This would allow users who have already anonymized their email address to continue to benefit.

We can further increase the security by encrypting the stored emails using an asymmetric key. The public part of the key can be stored on the server whereas the private part can be isolated to a different machine.

I haven't thought too much on this but it's possible to do this in a safe way.

The result

After all these measures have been taken, if Notesnook's database is breached there'd be no useful data for the attacker at all:

1. All user generated data will be encrypted (notes, notebooks etc.)
2. User's personal information will either not exist or will also be encrypted (email address)

Conclusion

Email is a necessary part of our digital lives & learning to share it safely is essential for our online privacy. Employing techniques such as email aliasing we can easily anonymize our online presence because we cannot always depend on the service provider to protect our privacy.

For the confused, due to a contract with Bing, DuckDuckGo cannot block 3rd-party Microsoft trackers on 3rd-party websites in the DuckDuckGo browser. For example, DuckDuckGo browser won't block Microsoft trackers on the New York Times website (if it exists there).

Is this bad? Yes and here's why.

Privacy is about trust

Even though DuckDuckGo browser & search are very different, the company & people behind them are the same. What does it mean for a company to be hand-tied in one of their products when it comes to privacy? It implies a severe weakness in all of their products: their dependence on Microsoft.

The question then changes to is it possible that DuckDuckGo will be forced (via a contract by Microsoft) to allow Microsoft tracking in their search? And suddenly it all starts looking worse and worse.

It's not important that DuckDuckGo doesn't do this currently. Even the fact that it doesn't block Microsoft trackers on 3rd party websites is unimportant. What's important is the reason why they do what they do & why they can't stop. Which brings us to...

Privacy is about independence

When DuckDuckGo launched, it was hyped as the privacy-focused alternative to Google & Bing. A lot of people migrated to DuckDuckGo & a lot of people still use it but DuckDuckGo wasn't the first (or the last) search engine to offer privacy focused interface to Bing or Google. StartPage, founded in 2006, used Google as their underlying search engine similar to how DuckDuckGo used Bing.

Is a search engine still private if it depends on one of the most privacy invasive search engines around? Perhaps. But launching a competing service that heavily relies on a rival for their core functionality is a time bomb.

All this isn't done in secret i.e., there are legal contracts between companies (Google & StartPage; Microsoft & DuckDuckGo) which allows DuckDuckGo to use Bing's search index. This puts a huge shadow on these privacy focused search engines. They cannot grow independently and while promoting privacy & freedom, these very services are bound by legal contracts to act otherwise.

There is no privacy or freedom if you are not independent:

1. Can DuckDuckGo exist without Bing? No.
2. Does Bing decide what to show me when I search on DuckDuckGo? In a way, yes.
3. Even though DuckDuckGo provides a filter between me & Bing, how impenetrable actually is that filter?

It doesn't matter if I am not directly being "coerced" by Bing. As long as I use DuckDuckGo it's essentially the same thing because Microsoft can (and does) coerce DuckDuckGo. Which brings us to...

Privacy is about financial freedom

DuckDuckGo's main source of revenue is search ads (like Google) which are Bing search ads. They cannot be profitable if they cut ties with Bing but it also means that Bing, and therefore Microsoft, controls their revenue stream and their business.

In their own words:

Microsoft and DuckDuckGo have partnered to provide a search solution that delivers relevant advertisements to you while protecting your privacy. If you click on a Microsoft-provided ad, you will be redirected to the advertiser’s landing page through Microsoft Advertising’s platform. At that point, Microsoft Advertising will use your full IP address and user-agent string so that it can properly process the ad click and charge the advertiser. — Ads by Microsoft on DuckDuckGo Private Search

This means that DuckDuckGo cannot make decisions that directly (or negatively) impact Bing or Microsoft. In other words, DuckDuckGo exists as long as Microsoft allows it to exist.

Conclusion

The fact of the matter is, Microsoft holds almost all the cards here and that's bad news if you care about privacy. This new controversy only makes DuckDuckGo's position weaker, no matter how passionately Gabriel goes about defending DuckDuckGo.

I don't trust Microsoft and consequentially I can't trust DuckDuckGo. I migrated to Brave Search when they launched their Beta and haven't looked back since. I love that they are independent both in terms of revenue & functionality.

But they weren't ready for Javascript.

The Curious Case of a <pre> tag

I was working on the Notesnook Web Clipper and testing it out on various different websites when I came across this anomaly on a Hackernoon blog post.

<p class="paragraph">bla bla bla
<pre><code>code</code></pre>
bla bla bla
</p>

You can inspect the actual source by yourself. Anywhere, you see an inline code, be sure that it's actually a <pre> tag.

There's nothing really wrong with this code syntactically. But browsers can't render it as it is, because ideally, <pre> tags should not be rendered inside <p> tags. So what do browsers do? They move the <pre> tag outside loyal to the HTML spec.

<p class="paragraph">bla bla bla</p>
<pre><code>code</code></pre>
bla bla bla
<p></p>

But that doesn't explain how Hackernoon guys were forcing the browser to render the invalid code.

Aside: Whoever runs the blog over at Hackernoon, kudos! But seriously, why not just use <code> for inline code instead of <pre> by forcibly display: inline it using CSS? I am genuinely curious.

Turns out the answer was quite simple: NextJS or more precisely: Javascript.

NextJS Hydration

How NextJS works is that it sends over a raw, static HTML blob which gets rendered by the browser. After the first render, this blob is hydrated and turned into a dynamic monster of a website. This allows you to have all the SEO benefits + a modern web experience. A cool strategy if the result before & after the hydration step looks visually the same.

In the case of Hackernoon, it doesn't.

To confirm my suspicion about Javascript being responsible for this, I manually throttled the network speed and stopped the hydration step. And lo and behold! The browser was working as it should i.e., it was automatically fixing the bad code as expected. So for sure the magic was somewhere in the client-side Javascript.

I opened the DevTools, switched to the console tab, and just for the heck of it tried putting a <pre> tag into a <p> tag. It worked.

const paragraph = document.createElement('p');
const pre = document.createElement('pre');
paragraph.appendChild(pre);

And then I realized, since NextJS is based on React which renders everything via Javascript where this restriction doesn't exist; this was happening automatically. I bet the folks over at Hackernoon don't even realize what's going on.

Does this work for all tags?

Next thing, I tried putting a <p> tag inside <br>. It failed of course but I received no errors. This was, however, expected because <br> tag doesn't have children.

But what about putting <pre> inside <script>?

const script = document.createElement('script');
const pre = document.createElement('pre');
script.appendChild(pre);
console.log(script.outerHTML);
// Result: '\x3Cscript><pre></pre>\x3C/script>'

(Strange how the < characters are printed as \x3C).

There's no way to render HTML inside <script> tag directly, right? This shouldn't work & it doesn't because everything inside <script> is supposed to be Javascript, right?!

<body>
  <script>
    <pre>hello</pre>;
  </script>
</body>

But what if you append a <script> that contains a <pre> inside it via Javascript? You get this.

This means you can write Javascript inside a <pre> tag and put it inside a <script> tag...and it will get treated like a normal <pre> tag by the browser. Crazy.

So what?

Okay yes, this isn't ground breaking but it is annoying. I can live with it but it raises a few questions:

1. Why not add checks to prevent this?
2. What else might be living around in browsers that can be similarly twisted & turned?
3. Is this intended? And if so, why prevent it on the inital render?

Maybe someone can reasonably answer those but one thing is for sure: Javascript adds a baffling amount of uncertainty & unpredictability to the web.

Anyone with your password could easily login & read your notes — a troubling thought, I know. To remedy this, we have now added 2FA. This blog post is about how we went about adding 2-factor authentication & why we made certain decisions along the way.

Choosing 2FA providers

If you have setup 2FA in other apps, you know how varying the different 2FA methods can be. Some services offer 2FA via SMS, others via an authentication (TOTP) app, or both.

In Notesnook, we went with 3 main options:

1. Authenticator app like Aegis or Raivo
2. SMS
3. Email

The security experts will, no doubt, balk at the thought of 2FA via email but let me explain. The more secure a method, the more cumbersome it becomes. For example, to setup 2FA via an authenticator app you have to go through multiple steps before you are done. There's no doubt about the level of security but it's also necessarily complex — not everyone's piece of cake

Obviously, the authenticator app is still the recommended method.

On the other hand, email is super easy. Almost everyone already has it and setting up 2FA takes less than a minute. This encourages even the laziest crowd to secure their accounts via 2FA.

Implementing 2FA

The most time consuming thing was fine tuning the UX behind 2FA. I researched the setup/auth flows of a lot of different services (Google, GitHub etc) and took the best thing from each.

I found GitHub's 2FA setup flow to be the most straight-forward with minimum amount of steps. Google's was most complex with a lot of back and forth. Discord's flow, while easy, was confusing.

In the end, I settled with a 3-step process:

1. Selecting a method
2. Verifying via the selected method
3. Backing up the recovery codes
4. Done

No navigation, no fancy animations, no back and forth — just a dialog that lets you enable 2FA in 3 steps.

The drama of SMS providers

The worst thing about being in Pakistan is that a lot of services simply refuse to offer their businesses here. I wanted to go with Twilio but they refused to accept Debit cards. After some more research, I found a couple of other providers:

1. Vonage — failed with an error at sign up & login. Support was no help.
2. Plivo — doesn't accept IPs from Pakistan
3. Bandwidth — only offers SMS services to US & Canada
4. MessageBird
5. Telnyx

I wasted a couple of hours trying out the first 2. I really liked Plivo's API that allowed sending custom 2FA codes at no extra cost. Unfortunately, they don't allow Pakistan.

Telnyx was a good option but I found their documentation a little confusing. In the end, I went with MessageBird. Aside from very competitive pricing, they have an absolutely gorgeous UI (and very easy to use dashboard).

MessageBird

The server-side logic took me about 10 minutes before I found out that MessageBird doesn't allow sending custom 2FA codes. Oops. Contacting their support was no help (although they responded very quickly).

I had to change the implementation details to allow MessageBird to verify phone numbers with their own codes but that's about it.

So far it has been working really good. Perfect choice.

The E.164 standard format

MessageBird only accepts phone numbers in E.164 standard format. What's E.164 standard? I have no idea (I didn't bother to read the document) but I got the basics of it after checking a few libraries.

Phone numbers have various formats:

+1 (292)-2292-291
(292)-2292-291
.
.

And this gets really hard to parse so there needs to be a standard — the E.164 standard. This turns a complex combination of symbols & digits into:

+12922292291

I am sure there's more to it. Obviously, I didn't go about doing this myself; I found this amazing library by AfterShip to do all the heavy lifting. Be sure to star their repo.

OAuth2 + MFA = Hard work

OAuth2 is very unclear about 2FA leaving it up to the developers to figure out — a risky thing for sure. I checked the Auth0 documentation and essentially stole their implementation idea.

A normal authentication flow works like this (very simplified):

Client -> user credentials -> auth server -> access token generation -> client

With the addition of 2FA, the above becomes:

Step 1: Client -> user credentials -> auth server -> 2FA detected -> 2FA token generation -> client
Step 2: Client -> 2FA code + user credentials -> auth server -> 2FA verification -> access token generation -> client

The difference between a 2FA token & an access_token is permissions. 2FA token only allows touching certain endpoints so nope, you won't be able to get users' notes with just the 2FA token.

The reason this is required in the first place is to prevent spam by making the 2FA endpoints public.

The End

All in all, it took us a week to finalize 2FA cross-platform and shipped in v1.8.3. Download Notesnook on all your devices to try it out!

On the other hand, React Native uses the platform specific rendering engines which is great but much slower. All this slowness is there because of a bridge which sends all information to Java/Objective-C in batches from the Javascript side. Since everything is single threaded, under heavy load the FPS drops; you see blank spaces in FlatLists, lag during scroll, and a lot of hang ups.

React Native had a good increase in performance when Hermes came out but soon the React Native team realized that the only factor holding back performance was the JS-Native bridge. React Native needed a better and faster way of communication with native side. So the React Native team started to work on the new architecture (JSI + Fabric + Turbo Modules).

Today the new architecture is in it's final stages and about to be released to the public in the next React Native release changing many things for React Native. However, it's still very uncertain (due to lack of proper documentation) how the new architecture actually works.

Currently only a handful of libraries have used this new architecture. The most prominent ones have been react-native-reanimated and @shopify/react-native-skia. Today we will be using @shopify/react-native-skia to build a fully native, 60 FPS, free-hand drawing app to explore the possibilities.

We will be building a very simple free-hand drawing app in React Native with the following features:

1. Free hand drawing
2. Color selection
3. Variable stroke
4. Undo/redo
5. Export the drawing to standard SVG format

Getting started

Create a new react native project

We are starting from a fresh react native project.

npx react-native init skia-drawing-app

Installing dependencies

react-native-skia is not yet released on npm hence we will add it directly from GitHub releases

npm install https://github.com/Shopify/react-native-skia/releases/download/v0.1.103-alpha/shopify-react-native-skia-0.1.103.tgz

And zustand for React state management.

npm install zustand

Project structure

.
┃  📦src
┃  ┣ 📂components
┃  ┃ ┣ 📜color.tsx
┃  ┃ ┣ 📜header.tsx
┃  ┃ ┣ 📜stroke.tsx
┃  ┃ ┗ 📜toolbar.tsx
┃  ┣ 📂drawing
┃  ┃ ┣ 📜constants.tsx
┃  ┃ ┣ 📜history.tsx
┃  ┃ ┣ 📜index.tsx
┃  ┃ ┗ 📜utils.tsx
┃  ┗ 📂store
┃  ┃ ┗ 📜index.ts
┣ 📜App.tsx

1. The components folder has the toolbar & all the basic components.
2. The drawing folder has all the logic + the drawing board.
3. We are using zustand for global state management. The store folder has our global state where we keep drawing paths and paint information.

Building the drawing board

The drawing board consists of 3 components: Header, Canvas and Toolbar interconnected by the global state as shown below.

1. The global state

We are using zustand for global state. The following interface will help you understand the purpose of each property in the state:

import { DrawingInfo, IPaint, IPath } from '@shopify/react-native-skia';

interface DrawingStore extends State {
  /**
   * Array of completed paths for redrawing on the `Canvas`
   */
  completedPaths: CurrentPath[];
  /**
   * A function to update completed paths
   */
  setCompletedPaths: (completedPaths: CurrentPath[]) => void;
  /**
   * Current stroke. Basically a paint object from Skia
   */
  stroke: IPaint;
  /**
   * Width of the stroke, used when creating stroke.
   */
  strokeWidth: number;
  /**
   * Color of the stroke
   */
  color: string;
  setStrokeWidth: (strokeWidth: number) => void;
  setColor: (color: string) => void;
  setStroke: (stroke: IPaint) => void;

  /**
  Width & height information of the canvas used for svg export 
  */
  canvasInfo: Partial<DrawingInfo> | null;
  setCanvasInfo: (canvasInfo: Partial<DrawingInfo>) => void;
}

The state stores and coordinates everything between all the different components.

2. Canvas

Canvas is where all the drawing takes place (obviously).

Objective: Draw a path when the user touches the screen & moves their finger, and save it.

import {
  Canvas,
  ExtendedTouchInfo,
  ICanvas,
  Path,
  Skia,
  SkiaView,
  TouchInfo,
  useDrawCallback,
  useTouchHandler
} from '@shopify/react-native-skia';
import React, { useCallback, useRef, useState } from 'react';
import {
  LayoutChangeEvent,
  SafeAreaView,
  useWindowDimensions,
  View
} from 'react-native';
import useDrawingStore, { CurrentPath } from '../store';
import Header from '../components/header';
import history from './history';
import Toolbar from '../components/toolbar';

const Drawing = () => {
  // Is user touching the screen
  const touchState = useRef(false);
  // Instance of canvas for imperative access
  const canvas = useRef<ICanvas>();
  // The current path which the user is drawing. The value is reset when finger is raised from screen
  const currentPath = useRef<CurrentPath | null>();
  const { width } = useWindowDimensions();
  // Array of completed paths from global state
  const completedPaths = useDrawingStore((state) => state.completedPaths);
  // A function in global state to add/remove paths
  const setCompletedPaths = useDrawingStore((state) => state.setCompletedPaths);
  // Stroke value from global state
  const stroke = useDrawingStore((state) => state.stroke);
  // Height of canvas, set on layout of View wrapping Canvas
  const [canvasHeight, setCanvasHeight] = useState(400);

  const onDraw = useDrawCallback((_canvas, info) => {
    if (!canvas.current) {
      useDrawingStore.getState().setCanvasInfo({
        width: info.width,
        height: info.height
      });

      canvas.current = _canvas;
    }
  }, []);

  // We need to provide absolute height to the canvas as percentages/flex won't work.
  // Therefore when the `View` renders, we get the height and keep it in state. This
  // height will be the height of Canvas & SkiaView components.
  const onLayout = (event: LayoutChangeEvent) => {
    setCanvasHeight(event.nativeEvent.layout.height);
  };

  return (
    <SafeAreaView
      style={{
        flex: 1
      }}
    >
      <View
        style={{
          backgroundColor: '#f0f0f0',
          flex: 1,
          alignItems: 'center'
        }}
      >
        <Header />

        <View
          onLayout={onLayout}
          style={{
            width: width - 24,
            flexGrow: 1,
            backgroundColor: '#ffffff',
            borderRadius: 10,
            overflow: 'hidden',
            elevation: 1
          }}
        >
          <SkiaView
            onDraw={onDraw}
            style={{ height: canvasHeight, width: width - 24, zIndex: 10 }}
          />

          <Canvas
            style={{
              height: canvasHeight,
              width: width - 24,
              position: 'absolute'
            }}
          >
            {completedPaths?.map((path) => (
              <Path
                key={path.path.toSVGString()}
                path={path.path}
                paint={{ current: path.paint }}
              />
            ))}
          </Canvas>
        </View>

        <Toolbar />
      </View>
    </SafeAreaView>
  );
};

export default Drawing;

The Drawing component is responsible for drawing paths on touch input. It consists of three Skia components.

1. SkiaView: Draws the current when user touches the screen and moves their finger.
2. Canvas: When the user raises their finger from the SkiaView that path is rendered on the underlying Canvas. This is why the Canvas component is rendered absolutely below the SkiaView.
3. Path: Once a path is drawn on SkiaView, it is added to completedPaths. Completed paths are rendered using the Path component declaratively.

To draw on the SkiaView we need an instance of the internal canvas to access the methods imperatively. We do this by subscribing to the onDraw callback. In the onDraw function we store a reference to the Canvas. We are also storing width & height of the Canvas in the global state.

The Drawing component is rendered in App.tsx like so:

import React from 'react';
import Drawing from './src/drawing';

const App = () => {
  return <Drawing />;
};

export default App;

Subscribing to touch events with useTouchHandler hook

To be able to draw on the SkiaView we have to subscribe to the touch events on the SkiaView. Whenever the user touches on the canvas and moves their finger, the onDraw callback is called with the relevant touch-point data. We will pass this data to our touchHandler which is a hook provided by react-native-skia.

  const touchHandler = useTouchHandler({
    onActive: onDrawingActive,
    onStart: onDrawingStart,
    onEnd: onDrawingFinished,
  });

  const onDraw = useDrawCallback((_canvas, info) => {
    touchHandler(info.touches);
...

We call the touchHandler function every time onDraw callback is called with data about the current touch.

The onDrawingStart callback

As soon as the user touches the screen, onDrawingStart is called.

const onDrawingStart = useCallback(
  (touchInfo: TouchInfo) => {
    if (currentPath.current) return;
    const { x, y } = touchInfo;
    currentPath.current = {
      path: Skia.Path.Make(),
      paint: stroke.copy()
    };

    touchState.current = true;
    currentPath.current.path?.moveTo(x, y);

    if (currentPath.current) {
      canvas.current?.drawPath(
        currentPath.current.path,
        currentPath.current.paint
      );
    }
  },
  [stroke]
);

1. We get the current x & y position of touch on the SkiaView.
2. We update the currentPath ref with a new path.
3. We set the touchState ref to true.
4. We move the pen in currentPath to x/y position with moveTo function so that drawing starts from this point.
5. Finally we draw the path on canvas with drawPath function.

The onDrawingActive callback

While the user moves finger on the screen, we update the path based on the movement.

const onDrawingActive = useCallback((touchInfo: ExtendedTouchInfo) => {
  const { x, y } = touchInfo;
  if (!currentPath.current?.path) return;
  if (touchState.current) {
    currentPath.current.path.lineTo(x, y);
    if (currentPath.current) {
      canvas.current?.drawPath(
        currentPath.current.path,
        currentPath.current.paint
      );
    }
  }
}, []);

1. We get the current x & y position of touch on the SkiaView.
2. We create the path using lineTo function to where the touch has moved.
3. Finally we draw the path on canvas with drawPath function. It takes two values. the current path and stroke information. The stroke contains information about the color, width & size of the stroke.

The onDrawingFinished callback

When the user raises the finger from the screen, we store the current path in global state using the updatePaths function and reset touchState and currentPath.

const onDrawingFinished = useCallback(() => {
  updatePaths();
  // reset the path. prepare for the next draw
  currentPath.current = null;
  // set touchState to false
  touchState.current = false;
}, [completedPaths.length]);

const updatePaths = () => {
  if (!currentPath.current) return;
  // Copy paths in global state
  let updatedPaths = [...completedPaths];

  // Push the newly created path
  updatedPaths.push({
    path: currentPath.current?.path.copy(),
    paint: currentPath.current?.paint.copy(),
    // The current color of the stroke
    color: useDrawingStore.getState().color
  });

  // Update history (will get to this later in the blog)
  history.push(currentPath.current);

  // Update the state.
  setCompletedPaths(updatedPaths);
};

Once the paths update, They are rendered on the Canvas below SkiaView as I mentioned above. We can also draw all the paths on the same SkiaView but it will be too intensive because all paths need to be redrawn every time onDraw is called.

So far you'll be able to draw multiple paths freely:

3. Toolbar

Our drawing app has a neat toolbar at the bottom having 3 main functions.

1. Set the color.
2. Set the stroke width.
3. Generate a stroke based on current color & width.

import React, { useState } from 'react';
import { StyleSheet, View } from 'react-native';
import Color from '../components/color';
import Stroke from '../components/stroke';
import useDrawingStore from '../store';
import constants from '../drawing/constants';
import utils from '../drawing/utils';

const Toolbar = () => {
  const currentColor = useDrawingStore((state) => state.color);
  const currentStrokeWidth = useDrawingStore((state) => state.strokeWidth);
  const setStrokeWidth = useDrawingStore((state) => state.setStrokeWidth);
  const setColor = useDrawingStore((state) => state.setColor);
  const setStroke = useDrawingStore((state) => state.setStroke);
  const [showStrokes, setShowStrokes] = useState(false);

  const onStrokeChange = (stroke: number) => {
    setStrokeWidth(stroke);
    setShowStrokes(false);
    setStroke(utils.getPaint(stroke, currentColor));
  };

  const onChangeColor = (color: string) => {
    setColor(color);
    setStroke(utils.getPaint(currentStrokeWidth, color));
  };

  return (
    <>
      {showStrokes && (
        <View
          style={[
            styles.toolbar,
            {
              bottom: 80,
              position: 'absolute'
            }
          ]}
        >
          {constants.strokes.map((stroke) => (
            <Stroke
              key={stroke}
              stroke={stroke}
              onPress={() => onStrokeChange(stroke)}
            />
          ))}
        </View>
      )}

      <View
        style={[styles.toolbar, { position: 'relative', marginVertical: 12 }]}
      >
        <View
          style={{
            backgroundColor: '#f7f7f7',
            borderRadius: 5
          }}
        >
          {showStrokes && (
            <View
              style={{
                width: 5,
                height: 5,
                borderRadius: 100,
                backgroundColor: 'black',
                alignSelf: 'center',
                position: 'absolute'
              }}
            />
          )}

          <Stroke
            stroke={currentStrokeWidth}
            onPress={() => setShowStrokes(!showStrokes)}
          />
        </View>

        <View
          style={{
            height: 30,
            borderWidth: 1,
            borderColor: '#f0f0f0',
            marginHorizontal: 10
          }}
        />

        {constants.colors.map((item) => (
          <Color key={item} color={item} onPress={() => onChangeColor(item)} />
        ))}
      </View>
    </>
  );
};

export default Toolbar;

Generating a stroke

You must be wondering what utils.getPaint does. The getPaint function is responsible for generating different kind of strokes using Skia.Paint:

import {
  PaintStyle,
  Skia,
  StrokeCap,
  StrokeJoin
} from '@shopify/react-native-skia';

const getPaint = (strokeWidth: number, color: string) => {
  const paint = Skia.Paint();
  paint.setStrokeWidth(strokeWidth);
  paint.setStrokeMiter(5);
  paint.setStyle(PaintStyle.Stroke);
  paint.setStrokeCap(StrokeCap.Round);
  paint.setStrokeJoin(StrokeJoin.Round);
  paint.setAntiAlias(true);
  const _color = paint.copy();
  _color.setColor(Skia.Color(color));
  return _color;
};

Wherever needed, we can update the current stroke of the next path that is drawn on canvas:

setStroke(utils.getPaint(currentStrokeWidth, item));

4. Header

The header component has buttons for undo, redo, reset and save.

import React from 'react';
import { Text, View, TouchableOpacity, StyleSheet } from 'react-native';
import useDrawingStore from '../store';
import history from '../drawing/history';
import utils from '../drawing/utils';

const Header = () => {
  /**
   * Reset the canvas & draw state
   */
  const reset = () => {
    useDrawingStore.getState().setCompletedPaths([]);
    useDrawingStore.getState().setStroke(utils.getPaint(2, 'black'));
    useDrawingStore.getState().setColor('black');
    useDrawingStore.getState().setStrokeWidth(2);
    history.clear();
  };

  const save = () => {
    let canvasInfo = useDrawingStore.getState().canvasInfo;
    let paths = useDrawingStore.getState().completedPaths;
    if (paths.length === 0) return;
    console.log('saving');
    if (canvasInfo?.width && canvasInfo?.height) {
      console.log(
        utils.makeSvgFromPaths(paths, {
          width: canvasInfo.width,
          height: canvasInfo.height
        })
      );
    }
  };

  const undo = () => {
    history.undo();
  };

  const redo = () => {
    history.redo();
  };
  return (
    <View
      style={{
        height: 50,
        width: '100%',
        paddingHorizontal: 12,
        flexDirection: 'row',
        justifyContent: 'space-between',
        alignItems: 'center'
      }}
    >
      <View
        style={{
          flexDirection: 'row'
        }}
      >
        <TouchableOpacity
          activeOpacity={0.6}
          onPress={undo}
          style={[styles.button, { marginRight: 10 }]}
        >
          <Text style={styles.buttonText}>Undo</Text>
        </TouchableOpacity>

        <TouchableOpacity
          onPress={redo}
          activeOpacity={0.6}
          style={styles.button}
        >
          <Text style={styles.buttonText}>Redo</Text>
        </TouchableOpacity>
      </View>

      <View
        style={{
          flexDirection: 'row'
        }}
      >
        <TouchableOpacity
          onPress={reset}
          activeOpacity={0.6}
          style={styles.button}
        >
          <Text style={styles.buttonText}>Reset</Text>
        </TouchableOpacity>

        <TouchableOpacity
          activeOpacity={0.6}
          onPress={save}
          style={[styles.button, { marginLeft: 10 }]}
        >
          <Text style={styles.buttonText}>Save</Text>
        </TouchableOpacity>
      </View>
    </View>
  );
};

export default Header;

1. Undo: Removes the last added path in completedPaths array.
2. Redo: Re-adds a path removed by undo.
3. Reset: Resets the drawing board to default state.
4. Save: Generate an SVG from all the paths in completedPaths.

History

History keeps track of all the changes on the drawing board.

import useDrawingStore, { CurrentPath } from '../store';

const history: {
  undo: CurrentPath[];
  redo: CurrentPath[];
} = {
  undo: [],
  redo: []
};

// Clear undo/redo stacks
function clear() {
  history.undo = [];
  history.redo = [];
}

// Push a new path to undo stack
function push(path: CurrentPath) {
  history.undo.push(path);
}

When users stops drawing. The newly created path is added to history with history.push function.

1. Undo

function undo() {
  if (history.undo.length === 0) return;
  // Get the last path in history
  let lastPath = history.undo[history.undo.length - 1];
  // Add the path to redo history
  history.redo.push(lastPath);
  // Remove path from undo history
  history.undo.splice(history.undo.length - 1, 1);
  // Update global state so the drawing board redraws
  useDrawingStore.getState().setCompletedPaths([...history.undo]);
}

2. Redo

function redo() {
  if (history.redo.length === 0) return;
  // Get last path from redo history
  let lastPath = history.redo[history.redo.length - 1];
  // Remove the path from redo history
  history.redo.splice(history.redo.length - 1, 1);
  // Add the path to undo history
  history.undo.push(lastPath);
  // Update the state
  useDrawingStore.getState().setCompletedPaths([...history.undo]);
}

Exporting the drawing as an SVG file

Once drawing completes, it can be exported to svg format using makeSvgFromPaths function

const makeSvgFromPaths = (
  paths: CurrentPath[],
  options: {
    width: number;
    height: number;
    backgroundColor?: string;
  }
) => {
  return `<svg width="${options.width}" height="${
    options.height
  }" viewBox="0 0 ${options.width} ${
    options.height
  }" fill="none" xmlns="http://www.w3.org/2000/svg">
    <rect width="${options.width}" height="${options.height}" fill="${
      options.backgroundColor || 'white'
    }"/>
  <g>

    ${paths.map((path) =>
      path.paint && path.path
        ? `<path d="${path.path.toSVGString()}" stroke="${
            path.color
          }" stroke-width="${path.paint.getStrokeWidth()}" stroke-linecap="${path.paint.getStrokeCap()}" stroke-linejoin="${path.paint.getStrokeJoin()}"/>`
        : ''
    )}
    </g>
    </svg>`;
};

For each path in completedPaths array, we generate a <path/> svg component with stroke, color and width from the path so that it matches the exact drawing.

const save = () => {
  // Get canvas info, basically width and height. This will be the size of svg.
  let canvasInfo = useDrawingStore.getState().canvasInfo;
  // Get the paths from global state
  let paths = useDrawingStore.getState().completedPaths;
  if (paths.length === 0) return;
  if (canvasInfo?.width && canvasInfo?.height) {
    // Generate the svg. Saving the svg to a file can be done here
    console.log(
      utils.makeSvgFromPaths(paths, {
        width: canvasInfo.width,
        height: canvasInfo.height
      })
    );
  }
};

Conclusion

Imagine the possibilities, the sheer butter-smoothness that can be achieved with react-native-skia! This was a very basic drawing app — touching only the surface of what's possible with this amazing library. Features like path selection, movement & resizing or animations can be easily added.

The only issue currently is the lack of documentation. I was unable to find anything about the imperative API of react-native-skia which forced me to delve into the codebase and figure everything out myself. But once proper documentation is finished, the whole ecosystem of React Native will change.

You can find the complete code for the above tutorial on Github. Free free to check it out & play with it.

NeutralinoJS was not a new idea --- instead of packaging the whole Node + Chromium with every app, why not reuse the already installed browser each OS comes with? Linux & macOS have WebKit while Microsoft Windows has IE, Edge, and now Chromium. A fabulous idea in theory but complications like native support for system tray, notifications, file system access, data storage, and security made many hesitate into actually making it a thing.

Released in 2018 by a Sri Lankan programmer, Shalitha Suranga, NeutralinoJS was one of the first frameworks to properly support 3 different desktop platforms while making it extremely easy for web developers. 3 years later, it has its own Javascript client library, support for extensions, and a very minimal footprint (< 3 MB).

While Tauri requires you to install Rust and a boatload of other things, NeutralinoJS stands on the shoulders of giants. It doesn't require learning a new language to take advantage of native capabilities. It lacks the huge npm ecosystem but supports a wide variety of system APIs under the Neutralino namespace. Currently it supports:

Ease of Use

• Neutralino.init
• Neutralino.app
• Neutralino.computer
• Neutralino.debug
• Neutralino.filesystem
• Neutralino.os
• Neutralino.storage
• Neutralino.window
• Neutralino.events
• Neutralino.extensions
• Neutralino.updater

Installation

Installing NeutralinoJS is as simple as:

npm i -g @neutralino/neu

And a few seconds later, you should have neu command available globally.

Hello Neutralino

Creating a new NeutralinoJS app is even simpler:

neu create <project-name>

However, most of the times you are either integrating into an existing codebase or you want to use a frontend framework like React. This is where NeutralinoJS shines.

Run the above command in your app's codebase. It should create a directory with the same name. All you have to do after that is edit the neutralino.config.json file. We'll edit 2 keys: url & documentRoot to point them to our framework's build directory. For React, it is:

"documentRoot": "./build/",
"url": "/index.html",

To start the app, enter:

neu run

And your app should open in a native window.

All in all, relative to Tauri, NeutralinoJS is extremely easy to setup and use. Of course, it doesn't have nearly all the features Tauri has but you can easily add those via native extensions.

Security

In terms of security, NeutralinoJS is a disappointment. It hosts the web app on a local server exposed on the localhost — all you have to do to access it is open a browser and go to http://localhost:some-random-port.

That's not even the worst thing. NeutralinoJS has a Javascript client library with many helpful functions to read files, write files, and access system info etc. This library is exposed on the client side as a global variable Neutralino. If you open the Developer Console in a Neutralino app, you can literally delete & list files using:

const files = await Neutralino.filesystem.readDirectory('.');
for (let file of files) {
  await Neutralino.filesystem.removeFile(`./${file.entry}`);
}

And viola! All files in your current working directory are now gone.

Very, very dangerous. I am aware that this is done for Developer experience but if, let's say, you wanted to load untrusted content in a NeutralinoJS app, I'd seriously reconsider. Most apps, however, only load local files for which NeutralinoJS is great. It'd still have been amazing if the client library wasn't exposed as a global variable.

Extensibility

Extensions in NeutralinoJS are simply programs that communicate over Websockets. Naturally, this allows the program to be written in any language or framework. This opens the possibility to write the backend in NodeJS, Rust or Go while the app is rendered in the native browser.

Since it's all Websockets, stuff like converting data structures, translating function arguments, reading results etc. are automatically handled by a lot of Websocket client libraries.

Publising & Updates

NeutralinoJS has no built-in system for receiving or installing updates nor does it have a proper bundler like electron-builder to make installers for each operating system. All this makes NeutralinoJS nonviable for any but the most trivial projects.

Running the neu build -r creates a .zip file containing binaries & resources for all 3 platforms. This works but there's no desktop integration, no icons, no way to install etc.

Migrating from Electron

Suffice it to say, there is 0 API compatibility with Electron. There's no node, no npm ecosystem, nothing like that. Your best bet to migrate an Electron app to Neutralino is either rewriting the backend code to a natively compiled language like Go or Rust or you can package the whole NodeJS along as a binary.

Final verdict

Having NeutralinoJS in the Native Javascript space provides necessary competition but it falls short of a lot of things required for a native app (even a native Javascript app) --- especially security. Combine that with this being mostly a hobby project run by a single developer with little financial (or other) support from the community, and you get something that is truly wonderful but not yet there.

Initially, I had plans to migrate Notesnook from Electron to Neutralino because the feature-set of NeutralinoJS is simply amazing. However, the security & reliability provided by Electron is simply unparalleled. If the developer works on bundling & security, NeutralinoJS can become an amazing alternative to Tauri & Electron.