N Safe Online Notepad

Privacy & Security Architecture

Last reviewed:

Most online notepads ask you to trust them with your notes. We built this one so we can't see your notes even if we wanted to. Below is the full technical breakdown of how that works — and how to verify every claim yourself.

Open the notepad →

On this page

  1. Summary in 30 seconds
  2. Where your notes live
  3. What our server sees (and doesn't)
  4. How shareable links stay private
  5. HTTP security headers we send
  6. Content Security Policy explained
  7. Tracking, cookies, and analytics
  8. Third-party dependencies
  9. How to verify everything yourself
  10. What this doesn't protect against
  11. Reporting security issues

Summary in 30 seconds

Where your notes live

Your notes are stored in your browser's localStorage under our domain's origin. This is the same browser API used by virtually every modern web app for client-side state. Three properties make it safe for our use case:

Verify it yourself

Open this page → press F12 → Application tab → Local Storage → our domain. You'll see your notes exactly as we store them. Then switch to the Network tab and type something into the notepad. You'll see zero outbound requests carrying your text.

What our server sees (and doesn't)

When you load this site, our web server logs the same minimal information every web server logs: the time of the request, your IP address, the URL you requested, and your browser's User-Agent string. We do not log:

Standard server logs are retained for a limited period for security and abuse-prevention purposes (detecting and blocking attacks), then purged. They are not joined to any other dataset, not sold, and not shared with advertisers — because we don't have advertisers.

How shareable links stay private

When you generate a share link, we encode your note's text into the URL fragment — the portion after the #. The resulting URL looks roughly like this:

https://safeonlinenotepad.com/#note=IyBNeSBub3RlCgpUaGlzIGlz...

The base64-encoded portion contains your note. Here's the security property that makes this private: per RFC 3986 §3.5 and the Fetch Living Standard, browsers do not transmit the fragment portion of a URL to the server. When someone opens the link, their browser fetches only the page itself; the note content is decoded client-side from the address bar.

Practical consequences:

Important caveat The fragment is private from our server, but it is not encrypted. Anyone you give the link to can decode the note (that's the point). Don't share secrets with people you don't trust, and be aware that browser history, screen captures, and chat clients may retain the link.

HTTP security headers we send

Every page response includes the following security headers:

HeaderWhat it does
Strict-Transport-SecurityTells your browser to never accept an unencrypted HTTP connection to our site again.
Content-Security-PolicyBlocks any script, style, image, or connection from a domain we don't explicitly allow. See below.
X-Content-Type-Options: nosniffPrevents browsers from MIME-sniffing responses, which blocks a class of injection attacks.
X-Frame-Options: SAMEORIGINPrevents other sites from embedding ours in an iframe (clickjacking protection).
Referrer-Policy: strict-origin-when-cross-originLimits what's sent in the Referer header when you click an outbound link.
Permissions-PolicyExplicitly denies access to camera, microphone, geolocation, USB, payment, and other powerful APIs we don't use.

Content Security Policy explained

Our Content Security Policy (CSP) is a list of rules the browser enforces about what resources our pages are allowed to load and execute. Here's the policy in plain English:

default-src 'self';
script-src 'self' 'unsafe-inline';
style-src 'self' 'unsafe-inline';
img-src 'self' data:;
font-src 'self' data:;
connect-src 'self';
frame-ancestors 'self';
base-uri 'self';
form-action 'self'

Translation:

Why this matters CSP is a defense-in-depth measure. Even in the worst case — say, an attacker somehow modifies our HTML — your browser would refuse to execute or load anything that violates these rules. Your notes can't be exfiltrated because there's no allowed destination for them to go.

Tracking, cookies, and analytics

We do not use:

We do not set tracking cookies. The only browser storage we use is localStorage, and it contains exactly three things:

  1. Your notes (under the key notepad.v1)
  2. Your theme preference (notepad.theme)
  3. Your font-size preference (notepad.fontsize) and word-wrap setting (notepad.wrap)

You can inspect each of these in DevTools. Nothing else is stored.

Third-party dependencies

We deliberately minimize external dependencies. The notepad's runtime has zero JavaScript dependencies. No React, no jQuery, no analytics SDK, no error reporter. Everything is vanilla HTML, CSS, and JavaScript served from our domain.

This is a security choice as much as a performance one. Every dependency is a potential supply-chain risk — see, for example, the 2018 event-stream incident, where a maliciously updated npm package siphoned cryptocurrency from users. With no dependencies, this category of attack is impossible.

How to verify everything yourself

Don't take our word for it. Verify each claim in your own browser:

1. Notes don't leave your browser

Open DevTools (F12) → Network tab → reload the notepad → type a long sentence. Watch the Network panel. No request appears containing your text.

2. No third-party domains are contacted

In the same Network panel, look at every request's Domain column. They should all show our domain — and nothing else.

3. The security headers are real

In the Network panel, click any request → Headers → Response Headers. You should see strict-transport-security, content-security-policy, x-content-type-options, and the others listed above.

4. There are no tracking cookies

DevTools → Application → Cookies → our domain. The list should be empty.

5. Shared links truly aren't transmitted

Open a share link with DevTools open. Look at the request URL in the Network tab. The portion after the # is missing — the browser stripped it before sending.

6. SSL/TLS is configured properly

Run our domain through SSL Labs' Server Test. We aim for an A or A+ rating.

What this doesn't protect against

Honesty is part of being trustworthy. Here's what our setup does not defend against:

For genuinely sensitive information — passwords, financial details, medical records — use a tool designed for that purpose (a password manager, encrypted notes app, or local-only text editor). A browser-based notepad is great for the 99% of notes that don't need that level of protection.

Reporting security issues

If you find a security issue, please email us at security@example.com. Coordinated disclosure is appreciated — give us a reasonable window to fix the issue before public disclosure. We will credit reporters who follow responsible disclosure in the changelog of any fix.

Back to the notepad →