Joplin: The Open-Source Note App Where Your Notes Are Just Markdown Files — and the Master Password You Cannot Afford to Lose
The test of a note-taking app is not what it can do on the day you install it. It is whether you can still read your notes in fifteen years, on a device you do not own yet, using software that may not exist.
Your notes are the most personal data you have, and they are the data most likely to outlive every tool you use to make them. Meeting notes from a job you left. Research for a project that shipped. The thing your grandmother said about a recipe. Ideas you wrote down years before you understood why they mattered.
Now consider where most of that lives. A proprietary database in a vendor's cloud, in a format you cannot read without their software, on a service whose pricing and terms can change with a blog post. Evernote has raised prices and restricted devices. Notion holds your workspace hostage to an export that produces imperfect Markdown. Every one of these companies has, at some point, changed the deal.
Joplin is the counter-proposal. Roughly
56,000 GitHub stars,
AGPL-3.0 for both the apps and the server, offline-first, storing your notes as Markdown in a local SQLite index, with optional
end-to-end encryption and a genuinely working self-hosted sync server. It runs on Windows, macOS, Linux, Android, iOS, and the terminal.
It is also the only note app I know of where a single forgotten password does not reset your account — it destroys your data irrecoverably. That is not a bug. It is what real end-to-end encryption means, and it is the thing you must decide about before you turn it on.
This is a deep-dive on how Joplin works, the six sync options and which ones actually make sense, what the encryption does and does not protect, what it costs, and the failure modes that catch people — including the one that is permanent.
1. What Joplin Is
Joplin is an
offline-first note-taking and to-do application. Notes are Markdown. They are stored locally in a SQLite database with attachments stored alongside. Sync is a layer on top, not a prerequisite — the app is fully functional with no network at all, which is a design position rather than a feature.
The clients:
- Desktop — Windows, macOS, Linux, built on Electron.
- Mobile — Android and iOS, built on React Native.
- Terminal — a full command-line application with its own editor.
- Web Clipper — Chrome and Firefox extensions that capture pages or screenshots into notebooks.
The server component,
Joplin Server, is optional. It is the first-party self-hosted sync target, and it adds multi-user support, note sharing, and publishing. Everything else works without it.
2. The Evernote Problem
It is worth being specific about what "owning your notes" actually means, because the phrase gets used loosely.
Format ownership. If your notes are Markdown files, any text editor ever written can open them. If they are rows in a proprietary database, only that vendor's software can. Joplin stores note bodies as Markdown. Your data outlives the app.
Storage ownership. Where do the bytes physically sit? With Joplin self-hosted, on a disk you control. With Evernote or Notion, on someone else's infrastructure, under their retention policy, in their jurisdiction.
Access ownership. Can you get everything out, in a usable form, on demand? Joplin exports to JEX (its own archive format), raw Markdown, PDF, and HTML. More importantly, you do not need to export — your notes are already Markdown on your disk.
Continuity ownership. What happens when the company pivots, gets acquired, or shuts down? With open-source software and an open format, the answer is "nothing." You keep using it. That is not a hypothetical comfort; it is the entire reason a note app should be open source.
The counter-argument deserves a hearing: hosted note services are genuinely better at some things, particularly real-time collaboration and search across everything. Joplin does not do real-time multi-user editing, and no amount of Markdown purity will change that. If live collaboration is your primary need, Joplin is the wrong tool and this article should end here.
There is a fourth dimension people forget until it bites them:
search and retrieval ownership. On a hosted service, search is good because the vendor indexes everything once, centrally, on hardware they control. In an encrypted, self-hosted setup, the server cannot index what it cannot read, so search has to happen on your device against a local index. Joplin's local search is good, but it is a different architecture with different limits — you will not get server-side full-text search across encrypted content from any tool that is honestly encrypted. That is a real trade, not a defect, and it is worth knowing before you wonder why it works the way it does.
3. Offline-First, and Why It Matters
Joplin's architecture is local-first in a way that many apps claim and few implement. The SQLite database on your device is the source of truth. The sync target is a replica. The app never waits for the network to show you a note you already have.
The practical consequences:
It is fast. No spinner before a note opens. Search runs against a local index.
It works on a plane. Entirely, with no degraded mode.
It survives the vendor. If every Joplin server on earth disappeared tomorrow, your notes would still be on your laptop, readable as Markdown.
Sync becomes a choice rather than a requirement. You can run Joplin with no sync at all, sync to a folder, or sync through infrastructure you own.
The cost of this design is the thing people complain about most:
sync is slower and more literal than a hosted service's. Because the sync target is treated as dumb storage — it holds blobs it cannot interpret, especially with encryption on — the protocol has to move whole items and resolve conflicts explicitly. It is reliable. It is not magic.
4. The Two Editors
Joplin offers both a
Markdown editor and a
Rich Text (WYSIWYG) editor, switchable per note.
The Markdown editor has a live preview, code blocks, tables, and the usual conveniences. It is the mode most long-term Joplin users settle into, because it matches the storage format and because Markdown is the reason your notes stay portable.
The Rich Text editor exists for people who do not want to think about asterisks, and it is genuinely usable. It is not a full word processor, and heavy formatting will frustrate you — Joplin's own documentation is candid that formatting options are more limited than a dedicated rich-text editor.
The honest recommendation: use Markdown for anything you care about keeping, use Rich Text for the shopping list.
5. Notebooks, Tags, To-dos, and Attachments
Organisation is hierarchical notebooks and sub-notebooks, plus cross-cutting tags. This is the Evernote model, and it is a sane one — a note lives in one notebook but can carry several tags.
To-dos are first-class: any note can become a task with a reminder and an alarm, and to-do notes appear in their own view. It is not a full task manager and should not be judged as one, but for "capture a task next to the note it came from" it is exactly right.
Attachments — images, PDFs, audio, video — are stored as resources alongside notes and referenced inline. You can attach a photo directly from the mobile app. Recent versions added whiteboard support and folded in previously-external plugins like freehand drawing and ABC music notation.
Full-text search works across all platforms, including attachments in many cases, and it is the reason a large Joplin notebook stays usable rather than becoming an archive you never open.
6. End-to-End Encryption: How It Works
This is the headline feature and the one that most needs explaining.
E2EE is optional and off by default. When enabled, notes, resources, and metadata are encrypted
on your device before upload, using
AES-256 with keys derived from a master password. The password is never transmitted to the server. The sync target stores ciphertext it cannot read.
That last property is the whole point:
E2EE works with sync targets you do not trust. If you are syncing through Dropbox, or through a Nextcloud someone else administers, or through an S3 bucket in a jurisdiction you are not fond of, enabling E2EE means whoever operates that storage sees only encrypted blobs.
Some operational facts worth knowing before you flip the switch:
- You enable it once, on any device, in the encryption settings under Synchronisation. Other devices prompt for the master password on their next sync.
- A GSoC project in 2024 substantially improved encryption and decryption speed and moved E2EE to a 256-bit key. Older installations may want to re-encrypt.
- Changing the master password after E2EE is enabled requires confirmation and re-keys your data. It is not instant on a large collection.
- Everything in the encrypted set is encrypted — including, importantly, some metadata, which is why search on the server side does not work.
7. The Master Password Is Unrecoverable
Read this section twice.
If you forget your Joplin E2EE master password, your encrypted notes cannot be decrypted. There is no reset link. There is no support ticket. There is no recovery question.
This is not a flaw in Joplin. It is the definition of end-to-end encryption. If the vendor could help you recover, the vendor would hold a key, and then it would not be end-to-end encryption — it would be encryption with a master key, which is a different and weaker thing. Every service that offers password recovery for "encrypted" data is telling you something about its architecture.
But the consequence for you is absolute. The practical rules:
1.
Put the master password in a password manager before you finish setting up E2EE. Not later. Before.
2.
Keep an unencrypted export of your notes somewhere safe, ideally updated occasionally. A folder of Markdown files costs nothing and is the actual insurance policy.
3.
Do not treat E2EE as your backup strategy. It is a confidentiality control. It is the opposite of a recovery mechanism.
There is a specific failure pattern worth naming: people enable E2EE, put the password somewhere they consider safe, change devices or reinstall an OS two years later, and discover the "somewhere safe" is gone. The failure is not immediate, which is why it is survivable in testing and devastating in year three.
My recommendation is not "do not use E2EE." It is:
use E2EE and export regularly. The combination gives you confidentiality against the server and a recovery path against yourself.
8. Six Sync Targets
Joplin is unusual in supporting many sync backends, which means you can pick based on what infrastructure you already have.
| Target | Self-hosted? | Notes |
|---|---|---|
|
Joplin Server | Yes (Docker) | First-party. Sharing, publishing, multi-user. |
|
Nextcloud / WebDAV | Yes | Most common self-hosted option without running Joplin Server. |
|
S3-compatible | Yes / cloud | MinIO, Garage, AWS S3. |
|
Dropbox | Cloud | Easiest for non-technical users. Use E2EE. |
|
OneDrive | Cloud | Same. |
|
Joplin Cloud | Commercial | Based in France, EU privacy law, E2EE. |
Joplin Cloud deserves a mention as the "I want to support the project and not run anything" option. It is hosted in France, which puts it under EU privacy law, and it implements E2EE. It is a legitimate choice for people who want the project to survive.
For anyone reading this blog, the interesting rows are the first three. Which brings us to deployment.
9. Joplin Server: Docker Deployment
Joplin Server is the first-party backend that replaces Dropbox or Nextcloud as the sync target. A minimal Compose setup:
``
yaml
services:
joplin:
image: joplin/server:latest
ports:
- "22300:22300"
environment:
- APP_BASE_URL=https://notes.example.com
- DB_CLIENT=pg
- POSTGRES_HOST=db
- POSTGRES_USER=joplin
- POSTGRES_PASSWORD=change-me
- POSTGRES_DATABASE=joplin
depends_on:
- db
db:
image: postgres:16
environment:
- POSTGRES_USER=joplin
- POSTGRES_PASSWORD=change-me
- POSTGRES_DATABASE=joplin
volumes:
- pgdata:/var/lib/postgresql/data
volumes:
pgdata:
`
Use PostgreSQL for production. The server supports SQLite for evaluation, and it is tempting, but SQLite on a sync server that takes concurrent writes from several devices is the kind of decision that produces intermittent corruption complaints six months in. Postgres is not much harder here.
Other things worth configuring:
APP_BASE_URL
must be the real public URL, or the client will generate links that do not work.
A filesystem storage driver is available for large content, which keeps big attachments out of the database.
Multi-user support means you can host for a family or a small team on one instance.
Note sharing and publishing only exist on Joplin Server — WebDAV and S3 give you sync and nothing else.
10. Self-Hosting Without Joplin Server
If you already run Nextcloud, you already have a Joplin sync target. Point Joplin at a WebDAV path and it works. This is the lowest-effort self-hosted option and the one most people should start with, because it adds nothing new to maintain.
S3-compatible storage is the most robust option if you already run MinIO or Garage, or if you want object storage's durability guarantees. It is a sync target only — no sharing, no publishing — but it is boring in the best way.
The decision rule is simple: if you need sharing or publishing, run Joplin Server. If you only need sync, use whatever storage you already have. The best self-hosted setup is the one that adds the fewest new failure modes.
11. Sync Is Not Backup
This is the mistake that costs people data, and it applies to every sync tool, not just Joplin.
Sync propagates deletions. Delete a note on your laptop, and the deletion propagates to the server and then to your phone. Sync's job is to make all copies identical. If "all copies identical" includes "deleted," then sync has faithfully destroyed your note everywhere.
What protects you:
- Joplin's note history, which keeps revisions of notes and lets you recover earlier versions. Check that it is enabled and that the retention window suits you.
- Regular exports to JEX or raw Markdown. A cron job that dumps your notebooks to a folder is fifteen minutes of work and is the difference between "I lost a note" and "I lost a week."
- A backup of the actual data directory and server database, if you run Joplin Server.
Note the layering: E2EE protects confidentiality from the server. Backups protect you from yourself. They are orthogonal, and you need both.
12. Conflicts
When two devices edit the same note before syncing, Joplin does not silently pick a winner. It keeps the conflicting version as a separate note with a conflict marker and lets you resolve it by hand.
This is the correct behaviour — silent last-write-wins is how people lose paragraphs — but it does mean conflicts accumulate if you ignore them. Get in the habit of dealing with conflict notes when they appear rather than letting them pile up.
The common cause is editing the same note on two devices within a sync interval, especially with a long-running note like a daily journal or a meeting log. If a note is edited frequently from several devices, consider whether it should be several notes.
13. The Exit Path
Import and export is where Joplin's open-format philosophy pays off.
Import: Evernote ENEX files (with formatting and metadata reasonably preserved), plain Markdown, and various others. The Evernote import is a major reason people arrive — it is the standard migration route off a platform that has raised prices on them one time too many.
Export: JEX (a Joplin archive), raw Markdown, PDF, and HTML.
The raw Markdown export is the one that matters. It produces a folder of .md` files with attachments, readable by anything, forever. That is your real insurance policy and it costs a few megabytes.
Migrating From Evernote, Realistically
Since most people arrive here from Evernote, the practical sequence is worth writing down.
First, export from Evernote as
ENEX. Evernote's own export produces one file per notebook, and large notebooks sometimes need to be exported in batches because the desktop client struggles with very big single exports. Do it notebook by notebook if the first attempt fails.
Second, import into Joplin on
desktop, not mobile — the desktop importer is the complete one, and a large import on a phone is an unpleasant experience. Joplin preserves note content, notebooks, tags, and creation metadata reasonably well. What it does not reliably preserve is Evernote-specific formatting: some inline styling, certain table layouts, and a few embedded widget types will come across as plain text or as an attachment.
Third,
do not delete the Evernote account on day one. Run Joplin for two weeks alongside it. The things that will catch you out are small — a note you reference weekly, a notebook you forgot existed — and they surface in use, not on inspection.
Fourth, accept that imports are never perfect. Budget an hour for tidying the notes you actually care about and leave the rest. The point of the migration is that your notes are now Markdown files on your disk, not that every table renders identically.
14. Web Clipper
The browser extension for Chrome and Firefox captures full pages, simplified articles, or screenshots directly into a notebook, with a choice of target notebook before saving.
It replaces the workflow that Evernote made famous and that most people still associate with that product. For research, it is the feature that determines whether a note app becomes where things go or where things you typed manually live.
The simplified-article mode is the useful one; the full-page mode produces clutter you will never read.
15. Plugins, Themes, and the Extension API
Joplin has a plugin ecosystem installable from inside the desktop app: kanban boards, advanced templating, math and diagram rendering, additional import and export formats, and various editor enhancements. Several plugins that were once external — freehand drawing, ABC music notation — have been folded into the core app.
There are also
custom themes, and an
Extension API for writing your own scripts, which is genuinely documented and usable if you want to automate something about how you take notes.
Two honest caveats. First,
the plugin ecosystem is smaller than Obsidian's — if a specific plugin is your reason for choosing a note app, check that it exists first. Second,
mobile plugin support has historically lagged desktop. Plugins are largely a desktop feature, and assuming otherwise leads to confusion.
16. The Terminal App
Worth mentioning because it is genuinely unusual: Joplin has a full-featured command-line client with a terminal UI for editing, plus commands for scripting.
If you live in a terminal, this is the difference between a note app you use and a note app you open twice a week. If you do not, ignore this section — but it is a nice signal about the project's priorities.
17. The Data API and Automation
Joplin exposes a local REST API — the
data API — on the desktop app, authenticated with a token, covering notebooks, notes, tags, and resources. Enable it in the settings, and your notes become scriptable.
This is one of those features that sounds like a developer curiosity and turns out to be the thing that makes the app stick. Some patterns:
Capture from anywhere. A script, a keyboard shortcut, or a cron job that creates a note via the API means your inbox for notes is Joplin regardless of what you were doing when the thought arrived.
Generate notes from other systems. Meeting summaries from a calendar, daily logs seeded from a template, a weekly review note pre-populated with the week's tags — all of it is a POST away.
Bulk operations. Rename, retag, move, or export across hundreds of notes without clicking. Joplin's UI is fine for ten notes and tedious for five hundred; the API does not care.
Sync to other consumers. Because the API is local and the storage is SQLite, some people read the database directly for reporting. That works, but prefer the API — the schema is not a stable contract and the API is.
One caveat: the API is
local and unencrypted on the wire by default, because it is designed for localhost. If you expose it beyond your machine, you have created an unauthenticated window into your entire notebook. Do not do that without putting authentication in front of it.
18. Where Your Data Goes
Self-hosted with Joplin Server, Nextcloud, or S3: your notes and attachments live on your infrastructure. With E2EE enabled, the server holds ciphertext it cannot read, so even a full compromise of the server yields nothing but encrypted blobs.
Self-hosted without E2EE: the server can read everything. If you are the only person with access to that server, this may be an acceptable trade — it makes server-side search and some features work — but understand the difference.
Joplin Cloud: hosted in France under EU privacy law, with E2EE. Strong posture, and the commercial option that supports the project.
Dropbox or OneDrive without E2EE: the provider can read your notes. This is the configuration where E2EE matters most, and it is the configuration where people most often skip it.
One thing that does not happen: Joplin does not phone home with analytics, does not require an account, and does not need a network connection to function. There is no telemetry story to audit, because there is no telemetry.
19. What It Costs
| Component | Evernote / Notion | Joplin self-hosted |
|---|---|---|
| Subscription | Per user, per month | $0, AGPL-3.0 |
| Storage | Tiered, capped | Your disk |
| Infrastructure | $0 | ~$3–5/mo VPS, or $0 on existing hardware |
| E2EE | Not really offered | Included |
| Device limits | Sometimes capped on free tiers | None |
| Maintenance | None | Updates, backups |
The honest cheapest path:
Joplin plus a Nextcloud you already run. Zero new infrastructure, zero new cost, and your notes are on hardware you already back up.
If you need Joplin Server, a small VPS plus a Postgres instance is a few dollars a month. For a family or small team sharing one instance, the per-person cost rounds to nothing.
The real cost is the same as every self-hosted tool: you own the updates, the backups, and the 2am failure. For a sync server, that burden is genuinely small — it is one container and one database, and if it is down, your notes are still on your laptop.
That is an unusually forgiving failure mode, and it is worth noting: Joplin going offline degrades to "sync paused" rather than "cannot work."
20. Joplin vs the Alternatives
Obsidian is the comparison everyone makes. It is the better knowledge-management tool — backlinks, graph view, and a much larger plugin ecosystem are core rather than add-on. It is also
proprietary, sync is a paid first-party service, and encryption is only available through that paid sync or third-party plugins. Choose Obsidian if your notes are a knowledge graph. Choose Joplin if your notes are notes and you want them open, encrypted, and free.
Standard Notes is closer to Joplin philosophically — open source, encrypted, self-hostable — with a plainer interface and a freemium model where some features require a subscription.
Notesnook is a newer open-source, E2EE-by-default contender with a more modern feel, worth evaluating if Joplin's interface does not work for you.
Trilium Notes is the powerful, deeply hierarchical option for people who want a personal wiki more than a notebook.
Notion and Evernote win on collaboration and polish and lose on everything to do with ownership.
Joplin's position is unfashionable and durable: a notebook, in Markdown, on your disk, encrypted if you want, synced wherever you like, with no account required.
21. Honest Limitations
No real-time collaboration. No multi-user editing of a note. Joplin Server has sharing and publishing, but this is not a collaborative workspace and never will be.
E2EE is off by default and the master password is unrecoverable. Covered. The single biggest risk in the product.
Sync setup is fiddly for non-technical users. Choosing a target, configuring credentials, and understanding E2EE is a real hurdle. This is the most common reason people bounce off Joplin.
Mobile performance degrades with very large notebooks. Thousands of notes with many attachments will make the mobile app sluggish.
Formatting is limited compared to a rich-text editor or Notion. If your notes are heavily designed documents, Joplin will frustrate you.
Plugin support on mobile lags desktop. Mostly a desktop feature.
The licence reports as NOASSERTION on GitHub because the repository contains multiple licences. The apps and server are AGPL-3.0; be aware of what that means if you plan to distribute a modified client.
Conflicts require manual resolution. Correct, but it is work.
The interface is utilitarian. Joplin looks like a tool. Some people find that refreshing; some people bounce.
22. Performance With Large Notebooks
Joplin handles thousands of notes comfortably on desktop. The SQLite index is fast and local search is responsive.
Where it degrades:
- Mobile apps with large collections, particularly with many attachments. Syncing a large notebook for the first time on a phone is slow and it is not unusual for it to take a while.
- Initial sync of an existing large collection to a new device. Budget time; do it on Wi-Fi.
- Attachment-heavy notebooks, because resources are separate items that must each sync.
Practical mitigations: keep attachment-heavy notebooks separate from text-heavy ones, avoid one enormous notebook in favour of several topical ones, and do the big first sync on desktop rather than mobile.
23. Troubleshooting
"Sync does nothing." Check the target credentials and the sync status panel for the actual error. Nine times out of ten it is a wrong URL or an expired token.
"It asks for a master password I never set." You enabled E2EE at some point, or another device did. Find the password. There is no other path.
"Notes are missing after syncing from a new device." Sync propagated a deletion, or the new device synced before completing its initial download and pushed an empty state. Restore from note history or your export.
"Conflicts keep appearing." Two devices editing the same note within the sync interval. Split the note or stop doing that.
"Mobile app is slow." Large notebook, many attachments. Reduce sync scope or split notebooks.
"Server returns 500 after upgrade." Database migration. Check the container logs; Joplin Server migrations are usually automatic but occasionally need a restart.
"Attachments do not appear." Resources sync separately from notes. Give it time, then check whether the resource sync is enabled.
24. Backup Strategy
Layered, in order of importance:
1.
Periodic raw Markdown export. The universal format. Works in fifteen years with software that does not exist yet. This is the one that actually matters.
2.
JEX export for a full-fidelity archive including notebooks, tags, and metadata.
3.
Server database and data directory backups, if you run Joplin Server. Standard Postgres dump, scheduled, with a tested restore.
4.
Local device backups — your laptop backup already covers the local copy, which is the primary one.
Note that layer 1 alone would save you from almost every realistic disaster. A folder of Markdown files, written to on a schedule, is the entire difference between an inconvenience and a catastrophe.
25. Who Should Use It, and Who Shouldn't
Use it if you want your notes to exist as plain files you control; you want real end-to-end encryption for free; you are migrating off Evernote and want a clean exit; you are offline often; or you want sync across your own devices without a per-seat subscription.
Think twice if you need real-time collaboration (this is not a workspace tool); you want a beautiful, heavily formatted writing environment (Obsidian or Notion); you are not comfortable configuring a sync target; or the idea of an unrecoverable master password is more anxiety than the confidentiality is worth.
Specifically consider Joplin Cloud or a hosted alternative if the operational burden genuinely outweighs the ownership benefit for you. That is a legitimate calculation, and it is better made honestly than by default.
26. The Verdict
Joplin is the best self-hosted Evernote replacement available, and it wins on the axis that matters most for a note app:
durability of your data rather than breadth of features. Fifty-six thousand stars, AGPL-3.0, Markdown on disk, offline-first, optional AES-256 end-to-end encryption, six sync targets, and a first-party server you can run in a container. No account required. No telemetry. No device limits.
The compromises are real and they are mostly the predictable ones. No real-time collaboration. A utilitarian interface. A plugin ecosystem smaller than Obsidian's. Sync configuration that will defeat some people on the first attempt. And mobile performance that suffers with very large collections.
The one that is not predictable, and the one you should decide about deliberately, is the master password. Joplin's encryption is real, which means there is no recovery path, which means the safety of your notes depends on a password you must not lose and an export you must actually run. Enable E2EE. Put the password in a password manager. Export to Markdown on a schedule.
Do those three things and Joplin gives you something no hosted note service can: notes that are yours, in a format that outlives the software, on hardware you chose, encrypted so that even the server holding them cannot read them.
Related
Comments (0)
No comments yet. Be the first to comment!