The short version
- Current clients encrypt REST-stored Markdown, titles, and supported images with AES-256-GCM before upload.
- The note key is carried after
#in the share URL, which browsers do not include in HTTP requests. - Live Yjs collaboration content is decrypted and visible to the relay while a room is active.
- Share metadata is visible to the server. Legacy notes may retain plaintext titles until updated by a current owner client.
These boundaries mean Note Colab is not wholly zero-knowledge or end-to-end encrypted.
What the service receives
| Data path | What the server or relay receives |
|---|---|
| Stored note body and title | AES-256-GCM ciphertext from current clients. |
| Supported stored images | AES-256-GCM ciphertext. Filenames and MIME types remain metadata. |
| Live collaboration | Decrypted Yjs text, operations, and collaborator state while the room is active. |
| Share records | Identifiers, access modes, timestamps, sizes, expiry, and collaborator identifiers. |
Links and access
A complete view-only or editable link is a bearer capability. Anyone who receives it may use its granted access and can copy decrypted content. Public-edit links also allow changes. Expiry and revocation reduce exposure but cannot recall information a recipient already copied.
Plugin and web credentials authorize account actions. Do not share API keys. Browser sessions are independently revocable. Optional provider sign-in authenticates an account, but it cannot derive the password-based vault key or silently replace the plugin credential and X25519 key. Protect your Obsidian vault and backups because plugin data and shared-note frontmatter contain credentials or note keys.
Operational trust
TLS protects credentials, ciphertext, live collaboration text, and metadata in transit. It does not hide live text from the relay endpoint. Use the hosted service only if you trust its operator, or connect the plugin to a compatible server you trust.
The public Obsidian plugin is available for inspection at github.com/felixleopold/notecolab.
Responsible disclosure
Open a GitHub issue without sensitive details to arrange a private report. Do not post credentials, complete share links, note keys, or private content.