Security

Security

CyberNotes includes robust security features: PIN or password unlock, offline recovery codes, auto-lock, privacy shield, and Caps Lock manager.

---

Unlock Method (Password or PIN)

Choosing a Method

1. Go to Settings → Security
2. Pick Unlock method: Password or PIN (4 to 8 digits)
3. Enter and confirm the new secret (current one required to change it)
4. Secrets are hashed with bcrypt before storage; reuse of the current secret is rejected

Recovery Code

Each lock secret should have a one-time recovery code:

1. After saving a password or PIN with no code configured, a dialog shows the generated code
2. Copy it somewhere safe away from this computer and confirm to continue
3. Regenerate anytime from Settings → Security (old code stops working)
4. Optional hint field, shown on the lock screen
5. Forgot flow on the lock screen: enter the code, set a new secret; 5 wrong tries trigger a 30-second cooldown

Password Hashing

• bcryptjs (pure JavaScript)
• Salted hashing
• No plaintext storage

Lock Screen

When locked:

• Password required to unlock
• Notes are inaccessible
• Timer shows time since lock

---

Auto-Lock

Configuration

Automatically lock after inactivity:

How It Works

1. No keyboard/mouse activity detected
2. Countdown reaches timeout
3. Lock screen appears
4. Password required to continue

Use Case

• Step away from computer
• Prevent unauthorized access
• Shared or public environments

---

Privacy Shield

What It Does

When the app is hidden or minimized:

• Screen shield activates
• Prevents shoulder surfing
• Hides note content from view

When It Activates

---

Caps Lock Manager

What It Does

Monitors Caps Lock state in the editor and can:

• Turn Caps Lock off after a configurable keyboard-idle period (5 seconds to 24 hours)
• Show the active state and countdown/progress in the title bar
• Display a dismissible notice after automatic shutoff
• Play optional sound notifications

Sound Presets

Sound Scope

Audio Technology

• Web Audio API synthesizer
• Zero external files required
• Pure JavaScript audio generation

---

Data Encryption

Storage

• SQL.js database stored locally
• Images in local app data
• No cloud transmission
• No server communication

What Stays Local