Joplin: Private Markdown Notes With Encrypted Sync (GitHub, Scanned)

Joplin is a notes and to-do app that keeps everything as Markdown, organised into notebooks with tags and full-text search. It is offline first: every note lives on your device, and sync is something you add, through Joplin Cloud, Nextcloud, Dropbox, OneDrive, WebDAV or a folder, with optional end-to-end encryption so the sync target only ever sees ciphertext.

It is the open-source answer to Evernote, and imports Evernote exports with formatting, attachments and metadata intact. There are apps for Windows, macOS, Linux, Android and iOS, a terminal client, a web clipper for Firefox and Chrome, and a plugin system with hundreds of community plugins for things like kanban boards, outlines and templates.

About 56,900 stars and 827 contributors, at v3.7.21 when scanned. Most of the code is AGPL-3.0-or-later; some directories, such as the sync server, carry their own licence. The editor is more practical than pretty, and heavy users with thousands of notes sometimes find the first sync slow.

• Repository: github.com/laurent22/joplin
• Licence: custom (Other)
• Language: TypeScript. Stars: 56.9K. Forks: 6,370. Last push: Oct 25, 2026.
• Scan: safe, Oct 26, 2026, commit 0c9e457

Who it is for

People who want their notes in an open format on their own devices, Evernote refugees, and anyone who needs encrypted notes synced through a service they already use.

Getting started

1. macOS (Homebrew)

brew install --cask joplin

2. Windows (winget)

winget install Joplin.Joplin

3. Terminal app (any OS with Node.js)

npm install -g joplin

Phones get it from the App Store or Google Play; installers for every desktop are on joplinapp.org. Turn on encryption under Synchronisation, Encryption before the first sync, and keep the master password somewhere safe: without it the notes cannot be recovered.

Safety scan

We cloned laurent22/joplin at commit 0c9e457 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• All 6 secret hits are test material: RSA keys in packages/lib/services/e2ee/ppk/ppkTestUtils.ts used to test the end-to-end encryption, and a commented-out test key in the mobile app's buildStartupTasks.ts. The 3 very long lines are the same test data and a debug database populator.
• The 3 binaries are JoplinPortable.exe, the launcher for the PortableApps build, and two standard Android Gradle wrapper jars. The two bare-IP URLs are test cases for classifying AI endpoints as local or remote.
• 701 known advisories across 34 lockfiles sounds alarming but is mostly test fixtures: each sample plugin under packages/app-cli/tests/support/plugins has its own old lockfile, and two TinyMCE asset builders add more. None of those ship in the apps. The scanner read only 22 packages from the root yarn.lock, so the apps' main dependency tree was largely not checked.
• The postinstall and prepare hooks only build the project when you install it from source (husky and gulp build). The CI script that uses sudo runs on build machines.
• 10 workflows; two use pull_request_target (PR title check and CLA), neither checks out the pull request. None of the 5 third-party actions is pinned to a commit. Security policy and Renovate present. OpenSSF Scorecard 4.6.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JSON 424K, TypeScript 411.2K, JavaScript 60.7K, Markdown 38.2K, Rust 18.7K, CSS 6,858.

Questions

Is Joplin free?

Yes. All the apps are free and open source, mostly under AGPL-3.0-or-later. Joplin Cloud is an optional paid sync service; you can sync free through Nextcloud, Dropbox, OneDrive, WebDAV or a local folder instead.

Is Joplin end-to-end encrypted?

It can be. End-to-end encryption is optional and works with every sync target. Once on, notes are encrypted on your device before upload, and only devices with your master password can read them.

Can I import my Evernote notes into Joplin?

Yes. Export your notebooks from Evernote as ENEX files and import them in Joplin. Formatting is converted to Markdown, and attachments, images and note metadata come across.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.