A small drawer inside the vault, for the things you write down once.

The five things people actually store

Encrypted Notes is a feature that quietly justifies itself. We did not include it because it tested well in user interviews; we included it because the AppVault team kept hitting the same small need ourselves. Five categories of material come up over and over.

1. Two-factor backup codes

Every reputable service that offers two-factor authentication also offers a set of one-time backup codes you can use if your authenticator app is lost. The codes are typically eight to ten in number, eight to twelve characters each, and supposed to be printed and stored offline. In practice, people email the codes to themselves or save them in a notes app where they are one cloud-account-compromise away from being useless.

Encrypted Notes is the right home for these. You paste the codes once. You retrieve them only when you actually lose access. Between those two events, they live behind your 5×5 pattern.

2. Cryptocurrency seed phrases

A twelve-word or twenty-four-word seed phrase is the only thing standing between you and your wallet. It is also a string of words you would never want a password manager (with its breach surface) to hold or a cloud-synced note (with its account dependency) to store. The conventional advice is metal-stamped storage in a fireproof box — and that is the right advice for the canonical copy. A second copy in Encrypted Notes is a useful "in your pocket" backup for the case where the fireproof box is far away.

3. The AppVault recovery passphrase

This is the meta case. AppVault offers a 24-word recovery passphrase during setup, intended to be written down and stored offline. If you choose to store it digitally as well — a defensible choice for people who travel and may need to reset a lost device on the road — Encrypted Notes is the only place inside AppVault’s own ecosystem where the passphrase makes sense. Storing the passphrase outside AppVault (in Apple Notes, in your password manager) is also defensible. Storing it inside AppVault recovers a cyclic safety: if you forget the pattern, the passphrase recovers the vault; if you write the passphrase in the vault, you have not removed the bootstrap problem.

4. Government identity numbers

Passport numbers, national ID numbers, driver’s license numbers, social security or social insurance numbers. The kind of number that requires you to find a physical document every time it is asked for, and that you do not want a phishing form to autofill. A short Encrypted Note lets you look them up in three seconds without exposing them to autocomplete.

5. Account hints and security question answers

The "mother’s maiden name", "first pet’s name", "high school mascot" pattern is a security antipattern — these answers are often public — but for now, many services still require them. The right move is to store unique made-up answers per service rather than the real answers. Encrypted Notes is a reasonable place for that table; a password manager is the canonical place if you already use one.

What Encrypted Notes deliberately does not do

Privacy products fail when they try to be everything. AppVault’s Encrypted Notes are intentionally narrow.

No autofill. We do not surface notes into web forms or other apps. The closest thing to autofill is the iOS share sheet, which lets you copy a note’s content into your clipboard — a deliberate, manual action.

No browser integration. No browser extension exists. No URL field on the note. No "fill on this site" automation.

No password generation. We do not offer a built-in random password generator. Use the one inside Safari, 1Password, or Bitwarden — they exist and they are good.

No category-based sorting beyond tags. Encrypted Notes is not trying to be a database. A note is a piece of text with a title and optional tags. If your use case requires structured fields and per-field encryption, you want a password manager, not a vault’s notes drawer.

How notes sit inside the vault

Inside AppVault, notes appear as a separate tab next to Photos and Files. The pattern that unlocks the vault unlocks all three. Each tab has its own list view; the contents are stored in the same encrypted container with the same catalog structure.

If you have Encrypted iCloud Backup enabled, notes are backed up the same way photos are — sealed locally with the per-device backup key, uploaded as opaque ciphertext, restored on a second device by re-deriving the key from your pattern.

The Decoy Vault has its own notes. If you keep a primary vault and a decoy vault with different patterns, each maintains its own notes list. The notes in your primary vault do not appear in the decoy and vice versa.