Alien Notes

• Notes and checklists — a note is free text (up to 100,000 characters), a checklist has up to 200 entries with boxes, "done to the bottom" and "clear ticks". Switch a note between the two: lines become entries and back, with a warning whenever something would be shortened.
• No save button — the app saves as you type (after 1.5 s) and when you leave the note, encrypted, the whole file every time. The title may stay empty; the first line then serves as the title.
• Markdown preview per note (switch, off by default) — headings (# to ###), bold, italic, lists, boxes (- [ ], - [x]), code, rules. A small own subset, no third-party renderer, no HTML, links deliberately stay plain text — the app has no network anyway. A cheat sheet in the editor shows "type this → looks like this" and inserts an example note on request.
• Categories like folders (type freely, suggestions from existing ones, filter chips above the list, rename a category with all its notes), favourites, pinned notes at the top, an "Open" chip for checklists with unfinished entries, search across title, text, checklist entries and category. "Insert date" puts date and time at the cursor.
• Moving from Standard Notes (since 1.1) — reads a decrypted Standard Notes backup, the downloaded ZIP directly or the text file inside. Plain, Markdown, code, rich-text and Super notes become notes, checklists become checklists, the first tag becomes the category. Authenticator (2FA) entries, spreadsheets and files are never imported; a second import creates no duplicates.
• Several at once (since 1.1) — pick notes and move them to the trash together (one "Undo" for all, at most 200 at once), set a category or the favourite mark. Plus "Undo" after moving to the trash (six seconds), "no preview" per note, three font sizes — and every confirmation is an in-app dialog, because the Android system dialog does not inherit the screenshot protection.
• Copy with auto-clear — "Copy" puts the whole note into the clipboard; the app clears it after the set time (15/30/60 s, default 30 s, can be switched off) and on lock. In the Android app copied content is flagged sensitive so the system preview hides it (Android 13+). With "Lock in background: immediately" the copied note stays until the chosen time runs out so it can still be pasted into another app (since 1.3).
• Locking, more relaxed than a password manager — by default no lock after inactivity and in the background only after 30 minutes, both adjustable up to "never" / "immediately". The background lock applies when you return after the chosen time; until then the key stays in memory. "Lock now" clears the key and everything on screen at once. The file on the device is always encrypted. With "immediately" the Android app also locks while the file picker is open; unlock within five minutes and the import continues with the chosen file (since 1.2).
• Trash — deleted notes stay restorable for 30 days, up to 200 notes at a time; it shows only title, type and date, never the content. It is device-local: when merging, a deletion travels to your other devices, the content does not.
• Encrypted backup & merge — the .notes file is fully encrypted. Per note the newer change wins, deletions are carried for a year. Sync e.g. via Syncthing, also between phone and Linux desktop.
• Aegis hurdle (optional) — an extra TOTP code from Aegis on unlock; key or otpauth link to copy, no QR. Honestly documented as a hurdle, not a second factor.
• Fingerprint unlock (optional, Android) as in Alien Pass, with the passphrase required after every restart unless "also after a restart" is ticked when enabling (off by default). Quick unlock by PIN (optional, desktop only) after a lock.
• Screenshots and app-switcher preview (Android) — blocked by default (FLAG_SECURE), can be switched off in Settings, because notes are not always secret. Locked and during setup the protection is always on.
• No Android autofill, not even third-party (since 1.4) — the app keeps its WebView out of the Android autofill framework. A password manager set up as the autofill service never sees the passphrase fields and cannot offer to save them. The HTML attribute autocomplete="off" alone does not stop this, hence natively.
• Bilingual — German and English, offline manual inside the app.

• Argon2id derives the key from your passphrase (32/64/128 MiB, self-benchmarked at setup) — memory-hard, so expensive for GPU attacks on a stolen file.
• AES-256-GCM via WebCrypto. Own file format AINV1 with its own keys — Alien Pass rejects a notes file and vice versa.
• Markdown without attack surface. The preview is rendered only via createElement/textContent — no HTML, links stay plain text.
• No internet permission. Only USE_BIOMETRIC and USE_FINGERPRINT (up to Android 8.1) for the fingerprint sensor, plus the AndroidX-generated signature permission that grants nothing. Strict CSP: connect-src 'none', no inline script.
• No cloud, ADB or device-to-device backup. allowBackup=false plus data extraction rules — you make backups yourself via the encrypted .notes file.
• Notes file in the private app folder, written atomically (temp file, fsync, rename) — never a half-written file. The 20 MB file limit is enforced on save as well; an oversized file still opens so you can tidy up.
• Internal security audit of the surface that is new compared to Alien Pass, before release (no independent audit): seven low-severity findings and one note, all fixed; a follow-up covered the file store and the 20 MB write limit added afterwards (one finding, also fixed before release). A second internal audit (25–26 September 2026, before 1.1) took apart the Standard Notes import including the ZIP reader, the confirmation dialog, undo and multi-select: no path from a foreign backup into markup or script; five findings without an outside attacker (among them a race on saving on Android, present since 0.1, that could silently drop a change), all fixed before release and covered by regression tests. Bundled Argon2 library (hash-wasm) hash-checked in the build.

Limits, stated honestly

• The keyboard learns along. It learns from what you type; a WebView cannot switch that off. If you do not want that, use a keyboard without personalised learning.
• "Never" means: key in memory. With "never" as the background lock, the key stays in memory until the system ends the process. Even with the default (30 minutes) it stays there until you return. "Lock now" clears it at once.
• FLAG_SECURE has limits. It blocks screenshots and the app-switcher preview; it is no protection against accessibility apps, root or a camera. If you switch it off, the unlocked app loses this protection.
• Clipboard in the background. The Android app only clears it as long as Android has not frozen the app (usually after the second app switch); otherwise on return. From Android 13 the system clears it by itself after about an hour, older versions do not.
• On the desktop no protection against screenshots and no automatic lock on screen lock or suspend — details in the Linux desktop section.

flatpak remote-add --user --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

gpg --import alien-investor-release-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS      # expected: Good signature from "Alien Investor (Release-Signatur) …"
sha256sum -c SHA256SUMS                     # expected: …flatpak: OK

flatpak install --user alien-notes-1.5-linux-x86_64.flatpak
flatpak run org.alieninvestor.notes

flatpak uninstall --user org.alieninvestor.notes    # deletes NO data (without --delete-data)
flatpak install --user alien-notes-X.Y-linux-x86_64.flatpak

flatpak info --user --show-permissions org.alieninvestor.notes

[Context]
shared=ipc;
sockets=wayland;fallback-x11;
devices=dri;

The desktop version, honestly assessed

• No network, enforced by the system. A Flatpak without network permission and without file access; files only through the system file dialog.
• Its own browser engine. The desktop app ships Electron itself. Updates for it only arrive with a new app version, not through the system.
• Limits: no protection against screenshots. Under X11 every program can read keyboard and clipboard. On screen lock and suspend the app does not lock by itself — Ctrl+L locks immediately. No fingerprint.
• Quick unlock with a PIN (optional) — taken over from Alien Pass: the PIN only protects a copy of the key in memory, at most 24 hours, never the file. The detailed assessment is on the Alien Pass page.

Open source on Codeberg

The client code is open source (MIT license) and free, the desktop shell is fully in the repo. No accounts, no server dependency.

🔗 codeberg.org/Alien-Investor/alien-notes