Security: Passphrase, PIN and Secure Markdown

The Passphrase is set per workspace in Help → Configure Passphrase… and is the key to everything LightNote encrypts: connection passwords (.lnc/.lns), password cells of the Custom table and .lne files. The encryption is strong and portable (Argon2id + XChaCha20-Poly1305): an encrypted file opens on another machine once you re-enter the same Passphrase there. Keep it safe: without it, the encrypted data cannot be recovered. The Passphrase is cached only on the local machine (it never goes to Git).

To change the Passphrase, open the same screen and edit the Passphrase field (it comes filled with the current one). On confirm, LightNote automatically re-encrypts all the workspace's secure data — passwords in .lnc/.lns, the contents of .lne files and the password cells of Custom tables (.lnd) — from the old Passphrase to the new one. Decryption is all or nothing: if a single item fails to decrypt, nothing is changed and LightNote tells you which one. During writing, each file is copied to a backup before being rewritten; if one fails to write, LightNote asks whether to undo everything (restore the backups) or skip that file and continue (it keeps the old Phrase, with a warning at the end). (Passwords in "ask" mode have nothing to re-encrypt.)

The PIN (4–8 digits) is an optional local lock: it guards sensitive UI actions (revealing passwords, opening secure notes) without typing the Passphrase every time. It encrypts nothing and applies only to this machine.

The Secure Markdown file (.lne, under New → Secure Markdown File) is a note encrypted on disk: on open, LightNote asks for the PIN (if set) and the Passphrase, decrypts in memory only and re-encrypts on save (Ctrl+S). For safety, it never reopens by itself when the session is restored. Other than that, it is a note like any other: it has the AI assistant (Ctrl+K/Ctrl+I and the AI button on the bar), Ctrl+click on wikilinks and tags, opens links and shows the address in the status bar. Worth remembering what AI implies: the snippet you send leaves the machine if the chosen assistant is a cloud service; with a local model (Ollama, LM Studio) it does not. And secure notes remain outside Ask your notes — that one reads the workspace's .md files, and on disk an .lne is encrypted text.