A note link is convenient until it ends up in the wrong chat. Password protection adds an access check, but it helps to understand that check before you put private material in a note.
Set the password
Open a note you can access, then choose Manage Password in the editor toolbar. Enter a password and, if useful, a hint. Finish the dialog and confirm that the change succeeded.
Use a unique password rather than one you also use for email or banking. A password manager can generate and store it. Do not write the password in the note it protects.
Check it in a separate session
Your current session may remember that you have access, and an account owner may have access through their account. To check what another reader sees, open the link in a private browsing window where you are not signed in.
Try without the password first, then with it. If the note belongs to your account, another account may still be blocked: ownership and password protection have separate access rules. Read how note sharing works before sending its URL.
Make the hint useful without giving the answer
Hints are visible to people who reach the password prompt. Avoid birthdays, family names, or a description of the exact password.
- Better: “Stored in my password manager.”
- Riskier: “My dog's name plus my birth year.”
- Also reasonable: leave the hint blank.
Understand the limits
Password protection controls access through the application. It is not a promise of end-to-end encryption, where only your devices hold the keys. Do not assume that a password makes content unreadable to the service operator or encrypts every attached file.
KeepNotes does not offer a documented recovery promise for a forgotten anonymous note password. Keep a secure record and an exported copy of important text. The encryption explainer describes the different protections.
Before you send the link
Send a sharing password separately from the URL. Remove unnecessary personal details and check the recipient. On someone else's computer, sign out and close the browser session; closing one tab does not clear stored data or end every authenticated session.
