Website profiles · Technology insights · Alternatives

joplinapp.org

Joplin, the open source note-taking application

Paid content Multilingual
Visit website
Profile views 10 Outbound visits 1 Normal
Joplin Full homepage screenshot

At a glance

Category
Software & Apps
Language
English
Paid-content signal
Paid contentObserved
Registered
2019
Hosting
FastlyInferred
HTTPS certificate trusted
PassedObserved
Last updated

Website review

This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.

What is Joplin?

Joplin is a free, open-source note-taking app that stores your notes in an open format and syncs them across devices. It is aimed at people who want control over their data rather than a closed, cloud-only service. You can write in Markdown or a rich-text editor, attach images, video, PDFs and audio, and use it on Windows, macOS, Linux, Android, iOS and even a terminal.

What it does well

  • Capture in many forms: notes can include multimedia, math expressions and diagrams; the mobile app can take photos and save them into a note.
  • Sync where you choose: Joplin supports Joplin Cloud, Dropbox and OneDrive, so you are not locked to one storage provider.
  • Privacy by design: notes use end-to-end encryption, and the app is open source with an open note format, which reduces the risk of losing access if a vendor changes direction.
  • Extend and customise: plugins, custom themes, multiple editors and an Extension API let you adapt the app to your workflow.
  • Clip from the web: a browser extension for Chrome and Firefox saves web pages or screenshots as notes.
  • Collaborate if needed: Joplin Cloud adds note sharing and collaboration, plus the option to publish a note to a public URL.

Trade-offs to consider

Joplin is more configurable than a simple notes app, so the first setup — choosing a sync target, deciding between Markdown and rich text, and adding plugins — takes a little thought. Collaboration and publishing are tied to Joplin Cloud rather than being available with every sync provider. If you mainly want a frictionless, fully hosted experience with no setup decisions, a mainstream cloud notes app may feel easier; if ownership, encryption and portability matter more, Joplin is a strong fit.

As a concrete example: a researcher could clip sources with the web clipper, write in Markdown, attach PDFs, sync through OneDrive, and keep end-to-end encryption on — all without a subscription.

A useful next step is to download the desktop app, create a few test notes, and try one sync target before committing your real notes. Then decide whether you need Joplin Cloud for sharing or can stay with Dropbox or OneDrive. See Joplin for the download and setup details.

How does Joplin keep my notes private and secure?

Joplin keeps notes private through end-to-end encryption (E2EE) and by storing them in an open format you control. According to the site, notes are encrypted so that “no-one but yourself can access them,” and because the app is open source, you can inspect how it works rather than trusting a closed product. The same page says Joplin Cloud is based in France, so data held there falls under European Union privacy law, and that even Joplin Cloud cannot read your notes when E2EE is active.

In practice, E2EE matters most when notes leave your device for sync. If you sync through Joplin Cloud, Dropbox or OneDrive, the encryption is meant to protect the content in transit and at rest on the sync service. That means a provider storing the file cannot simply open it and read your text, images, PDFs or audio attachments. The site also describes saving notes in an open format, which reduces lock-in: you can export or move your data without needing permission from Joplin.

Where privacy depends on you

  • Your device passcode, disk encryption and screen lock still matter. E2EE protects synced data, not an unlocked phone or laptop.
  • If you publish a note to the internet to share a URL, that note is no longer private. The site presents publishing as a separate sharing feature, so use it deliberately.
  • Sharing with friends, family or colleagues through Joplin Cloud is collaboration, not secrecy. Everyone you invite can see what you share.
  • Web clipper saves can include sensitive pages. Review clipped notes before syncing them to a shared or work account.

A practical setup for a private notebook

  1. Turn on E2EE in Joplin before syncing anything sensitive.
  2. Choose a sync target you already trust, such as Joplin Cloud, Dropbox or OneDrive.
  3. Use a strong, unique passphrase for encryption and store it in a password manager.
  4. Keep personal and shared notebooks separate so a published or collaborative note does not expose private entries.
  5. Export a backup periodically, since an open format is only useful if you actually keep a copy.

If your main concern is a provider reading your notes, Joplin’s E2EE and open-source model are the relevant features. If your concern is a lost or stolen unlocked device, encryption alone will not save you. Start by enabling E2EE and confirming your device lock, then decide whether Joplin Cloud or another sync service fits your threat model. For details, see Joplin.

How do I sync my notes across devices with Joplin?

Joplin syncs by keeping a single copy of your notes in a sync target (a folder or account), then having each device read and write to that same target. You install Joplin on each device, point every installation at the same sync destination, and let it reconcile changes. Notes are stored locally in an open format and protected with end-to-end encryption, so the sync service stores encrypted data rather than readable notes.

Choosing a sync target

Joplin's own page lists Joplin Cloud, Dropbox and OneDrive as sync options, and you can also sync via a filesystem location such as a cloud-synced folder or your own WebDAV/Nextcloud-style server. The trade-off is mostly about who holds the data and how much setup you accept:

  • Joplin Cloud — the least setup, plus sharing and publishing features described on the site; hosted in France under EU privacy law. Best if you want collaboration and don't want to run anything.
  • Dropbox / OneDrive — convenient if you already pay for storage there; you're trusting a third party with encrypted blobs.
  • Self-hosted (WebDAV, Nextcloud, a synced folder) — most control, but you manage availability, backups and the server yourself.

How to set it up

  1. Install Joplin on each device: Windows, macOS, Linux, Android or iOS, with a terminal app also available.
  2. On the first device, open the synchronisation settings and pick your target, then enter the credentials or folder path.
  3. Let the initial sync finish before adding a second device, so the first device has uploaded everything.
  4. On the second device, choose the same target and the same credentials, then sync. It downloads what's already there.
  5. Repeat for each additional device. Enable encryption in the sync settings and set the same master key password everywhere.

A practical example: a writer with a laptop, phone and work desktop picks Joplin Cloud, syncs the laptop first, then the phone, then the desktop. Capturing a photo on the phone with the mobile app and syncing makes it appear on the laptop after the next sync.

Decisions that matter

  • Encryption password: it must match on every device and cannot be recovered if lost. Store it in a password manager before you enable encryption.
  • One target per profile: mixing targets across devices causes duplicates and conflicts rather than merging.
  • Sync frequency: mobile apps sync on launch and on a schedule, so a note written on your phone may not appear instantly on your desktop.
  • Conflicts: if two devices edit the same note offline, Joplin keeps a conflicting copy rather than silently overwriting; check for these after long offline periods.

Next step: pick one target, set it up on your primary computer, confirm a test note appears on one other device, and only then add the rest. For the official instructions and current option list, see Joplin. If you want a hosted target with sharing built in, compare it against Dropbox and OneDrive before committing your whole note history to one of them.

What is Joplin Cloud and when should I pay for it?

Joplin Cloud is the paid hosting and collaboration service built around the free, open-source Joplin note-taking app. You can use Joplin without it: notes are stored locally in an open format and can sync through services such as Dropbox or OneDrive. Joplin Cloud adds a first-party sync target plus sharing and publishing features, and it is operated from France under EU privacy law with end-to-end encryption, so the provider states it cannot read your notes.

When paying makes sense

  • You want sharing and real-time collaboration with family, friends or colleagues, rather than just your own devices.
  • You want to publish a note to the internet and send someone a URL.
  • You would rather pay a vendor whose business is the app than assemble sync from a general cloud drive.
  • You value EU-based hosting and an end-to-end encrypted first-party service.

When the free app is enough

  • You only need personal notes on your own devices and are happy syncing via Dropbox, OneDrive or another supported service.
  • You prefer to self-host or keep everything local.
  • You mainly want the clipper, Markdown/Rich Text editing, plugins and themes, which belong to the app itself.

Practical comparison

Need Free Joplin app Joplin Cloud
Personal notes, local storage Yes Yes
Sync across devices Via third-party services First-party service
Share or collaborate on notes No Yes
Publish a note as a public URL No Yes
End-to-end encryption Supported Supported

A concrete case: a small team that already writes in Markdown could keep private notebooks in the free app and pay only if shared notebooks and published links become part of the workflow. A solo user with a Dropbox account has little reason to switch.

Next step: check the current plan details and limits on the official Joplin Cloud page (Joplin) and compare them with what your existing cloud storage already covers.

How can I share or collaborate on notes with others in Joplin?

Sharing in Joplin works at two levels: private collaboration with specific people, and public publishing to a URL. Both are tied to Joplin Cloud rather than the free local app.

Private collaboration

With Joplin Cloud, you can share a notebook with friends, family or colleagues and edit notes together. This suits a small group working on the same material — a household shared list, a project team's meeting notes, or a study group's summaries. The trade-off is that collaboration depends on the subscription service rather than the open-source app alone, so if you only sync through Dropbox or OneDrive you get your own notes on your own devices, not shared editing.

Publishing a note to the web

Joplin Cloud also lets you publish a note to the internet and share the resulting URL. This is one-way: readers see the note, but they are not editing alongside you. Use it for things like a public how-to, a resource list, or a status update you want to point people to. If you need back-and-forth editing, sharing a notebook is the closer fit.

What stays under your control

The page states that notes use end-to-end encryption, so in a shared notebook the participants can read the content but the sync provider cannot. It also notes that Joplin Cloud is based in France, under EU privacy law. For a team handling sensitive client or personal material, that combination — encrypted content plus an EU-hosted service — is often the deciding factor.

Practical next step

Decide which of the two needs you actually have:

  • Others must edit the same notes → a shared notebook via Joplin Cloud.
  • Others only need to read one note → publish it and send the URL.
  • You just want your own notes on several devices → ordinary sync, no sharing needed.

If you are weighing alternatives, Obsidian and Notion take different approaches to collaboration and publishing, and are worth comparing before committing a team to one tool.

How do I save web pages or screenshots as notes in Joplin?

Use Joplin's web clipper browser extension to turn a page or a screenshot into a note. It is available for Chrome and Firefox, and it is the feature Joplin describes for saving web pages or taking screenshots as notes.

The basic flow is:

  1. Install the clipper from your browser's extension store and connect it to your Joplin app.
  2. Open the page you want to keep.
  3. Click the clipper icon and choose what to save — typically the full page, a simplified article, or a screenshot selection.
  4. The result lands in Joplin as a new note, where you can tag it, move it to a notebook, or edit it.

A practical example: you are researching a topic and find five useful articles. Clip each one as a simplified article so you get readable text without ads and navigation clutter, then tag them all research and add your own summary lines at the top. For a design reference or a chart that would be lost in text extraction, use the screenshot option instead and save it alongside a short caption explaining why you kept it.

Two decisions to make early:

  • Full page vs. simplified article. Full-page capture preserves layout and links but includes menus and ads. Simplified article is better for reading and searching later. Screenshot is best when visual layout matters.
  • Where the note goes. Decide your notebook and tag convention before you start clipping, or your clippings will pile up unsorted.

If you also want notes to appear on other devices, set up synchronisation — Joplin lists Joplin Cloud, Dropbox and OneDrive among the options. See Joplin for the clipper and download links.

Related questions

More questions →
Can Joplin Be Customised With Plugins and Themes?

Yes. Joplin supports plugins, custom themes, and a choice of text editors (Rich Text or Markdown), and you can build your own scripts and plugins through its Extension API. The web clipper for Chrome and Firefox extends the app further by saving web pages or screenshots as notes. This applies to the Joplin app itself; some collaboration and sharing features sit in Joplin Cloud rather than the plugin system.

What you can customise

Joplin's own description of the app lists these customisation options:

  • Plugins — extend the app's functionality.
  • Custom themes — change how the app looks.
  • Multiple text editors — work in either Rich Text or Markdown.
  • Your own scripts and plugins — build them using the Extension API.

The web clipper is a separate extension, available on Chrome and Firefox, that saves web pages or takes screenshots as notes.

How the pieces fit together

Customisation What it changes Where it comes from
Plugins Adds or extends features Joplin plugin system
Custom themes Visual appearance Joplin theme settings
Rich Text / Markdown editors How you write notes Built into the app
Extension API Lets you create your own scripts and plugins Joplin developer surface
Web clipper Captures web pages and screenshots as notes Chrome and Firefox extensions

What this means in practice

If your goal is to adapt Joplin to how you already work, the plugin and theme system is the main route: you install or write plugins for missing features, and apply themes to change the interface. If your goal is to capture material from the web, the clipper handles that from the browser rather than from inside the app.

Note that sharing notes with friends, family, or colleagues, and publishing a note to the internet via a URL, are described as Joplin Cloud features — not as plugin or theme capabilities. So customisation and collaboration are separate concerns.

Where to start

  • To browse or add plugins and themes, use the app's plugin and theme options.
  • To write your own, look at the Extension API.
  • To capture web content, install the web clipper in Chrome or Firefox.
  • To share or publish notes, look at Joplin Cloud.

For the current list of available plugins and themes, and the exact steps for installing them, check Joplin's own documentation and plugin listings, since these change over time.

What Are Open-Source UI Element Libraries and How Do They Differ From UI Frameworks?

An open-source UI element library is a collection of individual, ready-made interface pieces—buttons, cards, inputs, toggles, loaders—that you copy into your own project and adapt. A UI framework, by contrast, is a structured system of components, conventions, and often a theming layer that governs how your whole interface is built. The practical difference: an element library gives you a snippet; a framework gives you a way of working. If you need a polished button in ten minutes, reach for the element library. If you're building a 40-screen product with a team, you probably want the framework.

What "open-source UI element library" actually means

The term gets used loosely, so it helps to separate the parts:

  • Open-source: the code is publicly available, and the license tells you what you may do with it—copy, modify, redistribute, or use commercially.
  • UI element: a single, self-contained piece of interface, usually small enough to read in one sitting. A button with hover states, a pricing card, a search field.
  • Library: a browsable, searchable collection of those elements, typically contributed by many different people.

On a site like Uiverse, elements are shared by a community and written in plain CSS or Tailwind. You find one you like, copy the markup and styles, paste them into your project, and adjust colors, spacing, and text to fit. There's no package to install and no build step required—which is exactly the appeal, and also the source of most of the confusion.

Element library vs. UI framework: the core differences

Dimension Open-source UI element library UI framework / design system
Unit of reuse A single snippet you copy A component you import or call
Installation None; paste into your code Package install, config, sometimes a provider
Consistency Depends on you; each element may look different Enforced by shared tokens and APIs
Theming Manual edits per element Central theme/config file
Updates You own the copy; no upstream updates Version bumps bring fixes and changes
Accessibility Varies per contributor; must be checked Usually tested and documented
Best for Prototypes, landing pages, small sites, one-off needs Multi-page apps, teams, long-lived products
Learning curve Low—read the CSS Higher—learn the API and conventions

The table isn't a verdict. It's a map of trade-offs. Element libraries win on speed and freedom; frameworks win on consistency and maintenance.

Licensing and attribution: what to check before you paste

This is where people get into trouble, and it's worth slowing down for.

  1. Find the license. Every element or collection should state one. Common open-source licenses include MIT, Apache-2.0, and BSD. Some projects use copyleft licenses like GPL, which can impose obligations if you redistribute your code.
  2. Understand what the license permits. MIT and Apache-2.0 are permissive: you can typically use the code in commercial and closed-source projects. Copyleft licenses may require you to release derivative source under the same terms.
  3. Check attribution requirements. Permissive licenses usually require you to keep the copyright notice and license text somewhere in your project. That's a real obligation, not a formality.
  4. Look for per-element terms. On community sites, the site's overall terms and the individual contributor's stated wishes may differ. If a contributor asks for credit, honor it.
  5. When in doubt, ask or avoid. If a snippet has no license at all, you don't have clear permission to reuse it. Treat "no license" as "not open source," even if the code is publicly visible.

This article is general information, not legal advice. For commercial products with real exposure, have someone qualified review the licenses you're relying on.

How to use a community element in your project: a practical workflow

Here's a repeatable process that avoids most of the usual mess.

1. Start from a real need, not a browsing session

Decide what you need first—"a compact primary button with a loading state"—then search. Browsing aimlessly produces a pile of pretty snippets that don't fit together.

2. Copy the smallest version that works

Take the markup and the styles. Strip anything you don't need: demo wrappers, extra animations, decorative layers. Less code means fewer surprises.

3. Convert it to your conventions

If your project uses design tokens or CSS variables, replace hard-coded values:

/* Before: hard-coded */
.button { background: #4f46e5; border-radius: 8px; }

/* After: token-based */
.button { background: var(--color-primary); border-radius: var(--radius-md); }

This one step is what keeps a copied element from looking like a foreign object in your UI.

4. Check accessibility before you ship

Community elements vary widely here. Verify at minimum:

  • Keyboard focus is visible and the element is reachable by Tab.
  • Color contrast meets WCAG AA (4.5:1 for normal text).
  • Interactive elements use semantic HTML (<button>, not a clickable <div>).
  • Form inputs have associated labels.
  • Motion respects prefers-reduced-motion.

5. Test in context

Paste it into a real page with real content. Long labels, small screens, and dark mode break more copied elements than anything else.

6. Note where it came from

Keep a short comment or an internal credits file: source, license, date. Future you—and your legal reviewer—will be grateful.

Where element libraries genuinely shine

  • Prototypes and demos: you need something clickable today, not a design system.
  • Landing pages and marketing sites: a handful of distinctive elements, each custom.
  • Filling gaps: your framework lacks one specific component, and you don't want to build it from scratch.
  • Learning: reading well-made CSS is one of the fastest ways to improve.
  • Small projects: a personal site doesn't need a theming architecture.

Where they fall short

  • Consistency at scale: ten elements from ten contributors rarely look like one product.
  • Maintenance: you own every copy. When your design changes, you edit each one.
  • Accessibility debt: you inherit whatever the contributor did or didn't do.
  • No upstream fixes: a bug fixed in the original won't reach your copy.
  • Integration friction: different naming conventions, different units, different assumptions about resets.

When to choose which

Choose an element library when the scope is small, the timeline is short, or you need a few distinctive pieces rather than a whole system.

Choose a framework or design system when multiple people build multiple screens over months, when consistency is a product requirement, or when accessibility and theming need to be guaranteed rather than checked.

A hybrid works well for many teams: adopt a framework for the structural components—forms, navigation, layout—and borrow individual elements for the places where you want personality. Just route every borrowed element through the same token and accessibility checks, so it lands as part of your system rather than beside it.

The short version: open-source UI element libraries are a fast, flexible way to get good-looking interface pieces into a project. They are not a substitute for a design system, and the license and accessibility details are the part worth reading carefully.

How Does Joplin Sync Notes Across Devices?

Joplin syncs notes by connecting every device you install it on to the same sync target — Joplin Cloud, Dropbox, or OneDrive — so the app uploads your notes from one device and pulls them down on the others. You need the app installed on each device and the same sync service configured on all of them; notes are protected with end-to-end encryption (E2EE), so the sync provider stores encrypted data rather than readable note content.

What you need before syncing

  • The Joplin app on each device you want to use. It runs on Windows, macOS, Linux, Android, and iOS, and a terminal app is also available.
  • One sync target chosen for all devices. Joplin's site lists Joplin Cloud, Dropbox, and OneDrive as supported services. The same target must be set on every device, or they will not see each other's notes.
  • Your encryption credentials. Because notes use E2EE, a new device needs the encryption key/password to decrypt what it downloads.

How the sync works

  1. You write or capture a note on one device — text, images, videos, PDFs, audio, math expressions, or diagrams.
  2. Joplin uploads that note to your chosen sync target.
  3. Other devices connected to the same target download the change and decrypt it locally.
  4. The note is then available on your computer, phone, tablet, or terminal.

The sync target is a transport and storage layer, not a place where your notes are readable — E2EE is what keeps the content private in transit and at rest.

Choosing a sync service

Option What it gives you When it fits
Joplin Cloud Sync plus sharing notes with friends, family, or colleagues for collaboration, and publishing a note to the internet via a URL. Based in France, under EU privacy law. You want collaboration or note publishing on top of sync, or prefer EU-based hosting.
Dropbox Sync only, using your existing Dropbox account. You already use Dropbox and only need to move notes between your own devices.
OneDrive Sync only, using your existing OneDrive account. You already use OneDrive and only need to move notes between your own devices.

Joplin Cloud is the only option in the site's material that adds collaboration and public note sharing; Dropbox and OneDrive are listed purely as sync services. Pricing for Joplin Cloud is not stated in the available material, so check the Joplin Cloud page before assuming a cost or a free tier.

What sync does not do by itself

  • It does not merge accounts. All devices must point at the same target.
  • It does not remove the need for your key. Without the encryption credentials, a freshly synced device cannot read the notes.
  • It does not make notes readable to the provider. E2EE means the service — including Joplin Cloud — cannot access your note content.

Verifying it works

After configuring the same sync target on two devices, create a test note on one and wait for sync to complete, then check whether it appears on the other. If it does not, the usual causes are a mismatched sync target, a failed login to the sync service, or a missing encryption key on the second device.

Is Joplin a Good Fit for Your Note-Taking Needs?

Joplin is a strong fit if you want an open-source, cross-platform note-taking app that keeps your notes in an open format and offers end-to-end encryption (E2EE). It suits people who take multimedia notes, clip web pages, sync across devices, and prefer to own their data. If you mainly need real-time collaborative editing or a fully hosted, zero-setup service, evaluate Joplin Cloud and its sharing features against your needs before committing.

What Joplin Is

Joplin is an open-source note-taking application. According to the official site, it lets you capture thoughts and securely access them from any device. Notes are saved in an open format, and the app uses end-to-end encryption so that no one but you can access your notes.

It is available on Windows, macOS, Linux, Android, and iOS, with a terminal app also available.

Key Capabilities

Multimedia notes

Joplin supports images, videos, PDFs, and audio files. You can create math expressions and diagrams directly in the app, and take photos with the mobile app to save them to a note.

Web clipping

A web clipper extension for Chrome and Firefox lets you save web pages or take screenshots as notes.

Customisation

You can customise the app with plugins, custom themes, and multiple text editors (Rich Text or Markdown). You can also create your own scripts and plugins using the Extension API.

Sync and access anywhere

Notes sync across your computer, phone, or tablet through services including Joplin Cloud, Dropbox, and OneDrive.

Collaboration and sharing

With Joplin Cloud, you can share notes with friends, family, or colleagues and collaborate on them. You can also publish a note to the internet and share the URL.

Privacy and Data Ownership

  • Open source and open format: The app is open source and notes are saved to an open format, so you always have access to them.
  • End-to-end encryption (E2EE): Notes are secured so that no one but yourself can access them.
  • EU privacy protection: Joplin Cloud is based in France, so data is protected by strict European Union privacy laws. Joplin Cloud also implements strong end-to-end encryption, meaning even the provider cannot access your data.

How to Get Started

  1. Download the app from joplinapp.org for your platform (desktop, mobile, or terminal).
  2. Choose a sync target if you want notes on multiple devices: Joplin Cloud, Dropbox, or OneDrive.
  3. Optional — sign up with Joplin Cloud if you want hosted sync plus sharing and collaboration features.
  4. Add the web clipper from Chrome or Firefox if you want to save web pages as notes.
  5. Customise with plugins, themes, and your preferred editor (Rich Text or Markdown).

Is It a Good Fit? Quick Check

Your priority Joplin fit
Open-source, open-format notes Strong
Cross-platform access (desktop, mobile, terminal) Strong
End-to-end encryption and data ownership Strong
Multimedia notes and web clipping Strong
Plugin and theme customisation Strong
Hosted sync and note sharing/collaboration Available via Joplin Cloud
EU-based data protection Available via Joplin Cloud (France)

If your needs line up with the left column, Joplin is likely a good fit. If you require features not described here, check the official site and Joplin Cloud plans before deciding.

How does Joplin protect note privacy and data ownership?

Joplin protects note privacy and data ownership through four concrete mechanisms: it is an open-source app that stores notes in an open format, it applies end-to-end encryption (E2EE) so only you can read your notes, and its optional Joplin Cloud service is based in France under EU privacy law. According to Joplin's own site, E2EE is designed so that "no-one but yourself can access them" — and for Joplin Cloud specifically, "not even we can access your data." These guarantees apply to your notes; they do not by themselves cover metadata your sync provider might see, and they depend on you enabling encryption and keeping your password safe.

Open source and open format: ownership you can verify

Joplin describes itself as "an open source note-taking app" and states that "your notes are saved to an open format, so you'll always access them." Two practical consequences follow:

  • The code is inspectable. Anyone can review how notes are stored, encrypted, and synced rather than trusting a vendor's description.
  • Your notes are not locked into a proprietary database. An open format means you can read or move your data with other tools if you stop using Joplin.

Ownership here means portability and auditability, not automatic secrecy. An open format on an unencrypted device is still readable by anyone with access to that device.

End-to-end encryption (E2EE)

Joplin's site states the app "uses End-To-End Encryption (E2EE) to secure your notes and ensure no-one but yourself can access them." The key word is end-to-end: encryption and decryption happen on your devices, so the sync target in between stores encrypted data it cannot read.

What this protects and what it does not:

Protected by E2EE Not solved by E2EE alone
Note contents in transit and at rest on the sync service A weak or reused master password
Access by the sync provider or Joplin Cloud An unlocked, compromised device
Casual inspection of synced files Data you export or share in plain form

The security therefore rests on your encryption password. If you lose it, the encrypted notes are not recoverable by Joplin — that is the direct trade-off of "no-one but yourself can access them."

Joplin Cloud and EU privacy law

Joplin Cloud is the vendor's own sync and collaboration service. The site notes it "is based in France," so "your data is protected by strict European Union privacy laws," and that Joplin Cloud "implements strong end-to-end encryption so that not even we can access your data."

This matters if you want a single provider that is both the sync host and bound by EU rules. It is optional: Joplin also syncs with services such as Dropbox and OneDrive, in which case the legal jurisdiction and privacy terms are those of that provider, while E2EE still applies to note contents.

How to actually get these protections

  1. Install Joplin on your devices (Windows, macOS, Linux, Android, iOS, or the terminal app) from joplinapp.org.
  2. Choose a sync target — Joplin Cloud, Dropbox, OneDrive, or another supported service.
  3. Enable encryption in Joplin's encryption settings and set a strong, unique password.
  4. Verify by checking that synced notes show as encrypted on the sync target, and by confirming a note created on one device appears on another.
  5. Store the password safely (for example, in a password manager). Without it, encrypted notes cannot be decrypted.

Common sticking points: enabling E2EE after notes already synced means existing items must be re-encrypted and re-uploaded; a forgotten password is unrecoverable; and sharing a note publicly or via Joplin Cloud collaboration deliberately exposes that note's content beyond your own devices.

Who this suits

Joplin's privacy model fits users who want verifiable, portable, encrypted notes and are willing to manage an encryption password. It is a weaker fit if you need a provider to recover your data for you after a lost password, or if you mainly want zero-setup sharing — those goals conflict with "not even we can access your data."

Website Overview

An established domain and managed infrastructure suggest continuity of operations and may support dependable delivery, although neither guarantees service quality. Several search or sharing settings need attention. Together they may make snippets, preview images or preferred URLs less consistent across platforms.

Domain and Registration

Registered in 2019, this domain has about 7 years of history. That suggests continuity, although ownership and purpose may have changed. Transfer-protection status is present, helping reduce the risk of unauthorized domain transfers. The domain uses the common .org extension, which is not an independent safety signal.

DNS and Email

The observed email authentication setup is incomplete: DMARC is missing. Nameservers are provided by ovh.net, indicating managed DNS hosting. MX records point to the ovh.net email service. DNSSEC is enabled, allowing validating resolvers to authenticate signed DNS data. No CNAME was found; the observed records resolve directly to addresses.

TLS and Certificates

The certificate uses an RSA 2048-bit public key, offering broad client compatibility. The server supplied a complete certificate chain. No organization name is present in the certificate; the available fields are consistent with domain validation. The certificate was issued by Let's Encrypt, commonly associated with automated certificate services. The certificate's total validity is about 89 days, consistent with a short renewal cycle.

HTTP and Browser Security

The response lacks these common security headers: CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, clickjacking protection. CORS permits any origin to read this response. This is common for public resources; sensitive responses need narrower handling. No X-Powered-By header was found, reducing one common source of backend fingerprinting information. The x-cache, x-served-by, via response header indicates a CDN or caching proxy in the delivery path. No obvious internal addresses or debug information were found in the headers.

Technology Stack Analysis

The public page identifies Google Tag Manager, Google Analytics, Fastly without precise versions, leaving fewer clues for version-specific scanning.

Search and Social Sharing

No homepage canonical URL was detected. If duplicate URLs exist, consolidation may be less explicit. Open Graph is partially configured; og:image, og:type is missing. Twitter Card metadata is configured. The page declares 5 language or regional alternatives using hreflang. The title has 6 characters, within a common display range.

Hosting and Email

DNSovh.net
HostingFastly
Emailovh.net
Approximate IP geolocation (inferred; a CDN or proxy may differ from the origin server) United States flagUnited States Inferred 185.199.108.153

Registration details

RDAP / WHOIS

RegistrarOVH sas
Registered2019-04-05
Expires2029-04-05
Domain statusclient delete prohibited、client transfer prohibited
Nameserversdns20.ovh.net、ns20.ovh.net
DNSSECsigned

DNS records

DNS

TypeNameValueTTLPriority
Ajoplinapp.org185.199.108.1532728—
Ajoplinapp.org185.199.109.1532728—
Ajoplinapp.org185.199.110.1532728—
Ajoplinapp.org185.199.111.1532728—
MXjoplinapp.orgmx4.mail.ovh.net36001
MXjoplinapp.orgmx3.mail.ovh.net360010
NSjoplinapp.orgdns20.ovh.net3600—
NSjoplinapp.orgns20.ovh.net3600—
TXTjoplinapp.org1|www.joplinapp.org3600—
TXTjoplinapp.orgbrave-ledger-verification=815c8d9ae657961e6ca0bedbd4cf9429794578d9368818e13a03622c4a7c53f63600—
TXTjoplinapp.orggoogle-site-verification=Nb6eQbD36FfRxIofc1inzv15Q-6ZIO3HKPm0PuNGWQU3600—
TXTjoplinapp.orgv=spf1 include:mx.ovh.com ~all3600—
DSjoplinapp.org43937 8 2 0b2eb94f4e83c507137f9c41df7ad4c0d249d287f42c2878a7cb067eadc378e03600—

TLS and certificates

TLS / SSL

AssessmentNormal configuration
Supported protocolsTLSv1.2、TLSv1.3
Negotiated protocolTLSv1.3
Certificate subjectjoplinapp.org
IssuerLet's Encrypt
Valid until2026-11-26T05:13 · Remaining when checked: 59 days
Verification detailsCertificate trust: Passed · Hostname match: Passed

HTTP response headers

HTTP

HeaderValue
content-typetext/html; charset=utf-8
cache-controlmax-age=600
serverGitHub.com
strict-transport-securitymax-age=31556952
access-control-allow-origin*

Identified technologies

Google Tag ManagerGoogle AnalyticsFastly

Pages, Search and Sharing

User reviews (0)

  • No reviews yet.