bpad - Capture notes privately. The server can't read them.

bpad is an open-source, encrypted note-taking PWA for desktop and mobile that works offline. Notes are encrypted in your browser using Argon2id + AES-256-GCM before leaving your device. Only unreadable ciphertext reaches the server, meaning your notes are always at your fingertips across all your devices, yet completely private and unreadable to anyone else.

Hey Product Hunt 👋 I built bpad because I wanted a dead-simple place to dump notes without trusting a server to keep them secret. So I made the server incapable of reading them. How it works: - Your notes are encrypted in the browser with Argon2id (key derivation) + AES-256-GCM before anything is sent. The backend only ever stores iv + ciphertext — it's a zero-knowledge store by design. - Your password never leaves your device; the server gets a verifier, not the key. - Optional biometric unlock via WebAuthn PRF. - Installable PWA, reads offline, and you can export an encrypted backup so you're never locked out. Honest disclaimer: this is a personal project, not a company. I did a careful security review of the crypto/auth surface myself, but it hasn't had a formal external audit — so kick the tyres and tell me where it breaks. It's fully open source (AGPL-3.0) if you'd rather read the code than trust me: github.com/garnetstar-pro/bpad Would genuinely love feedback on the threat model and the UX. Thanks for taking a look 🙏

bpad - Capture notes privately. The server can't read them.

Replies