BitNote

Frequently Asked Questions

What is BitNote?

BitNote allows you to store encrypted text notes directly on a blockchain.

What can you store in a BitNote?

The note can store any text data (UTF-8).

Why BitNote?

We created BitNote because we ran into an annoying problem: where do you store secret information?
‍
The traditional advice is to use a fireproof safe that is bolted to the ground in a hidden place in your house. That’s great advice if you’re Batman. Unfortunately, for the rest of us that kind of physical security is not really feasible.

Many people turn to centralized password managers like 1Password or Lastpass. Not only can these have pricey subscriptions and the threat of going out of business, they can also have a lot of security issues. And because they are not open source, you never really know what’s going on with your data.

Even open source alternatives like Bitwarden can have frustrating flaws, like the ability to permanently delete your vault if someone gets access to your email or having access blocked because you use a VPN.

We’ve seen people store sensitive information in their Apple, Google, or Microsoft accounts (only sometimes encrypted), but what happens when they randomly decide to ban you or you get locked out of your account? Or worse, someone steals your phone and pin and now has access to everything.

We’ve seen people concoct crazy “security” practices like this poor soul, who split his crypto seedphrase between four excel files only to lose the data in a harddrive crash.

Even people who have high technical competency, like Bitcoin core developers, can have questionable security practices leading to hacks.

We searched for something that could store our secrets safely that would solve these issues. Decentralized, censorship resistant, permissionless, open source, private, permanent storage that is highly secure but easily usable and accessible. And we didn’t find it. So we built BitNote.

BitNote is built with simple, time tested technology: HTML, CSS, and Javascript. No frameworks. The entire app comes in well under 1MB in total size and is very fast. It’s designed to have no centralized dependencies and be resilient for many years to come––a "forever machine."

What's next? On the roadmap we're excited to solve the next big problem: how do you automatically pass down your important information if something happens to you? Decentralized succession will unlock a number of new, important use cases.

What are the use cases?

Some ideas of how to use BitNote:

- Decentralized password manager.
- Deadbox or dead man’s switch—storing information that you want passed down in case something happens to you.
- Secure storage for seed phrases, private keys, recovery keys, safe combinations, and other secret information.
- Secure sharing—send encrypted messages that only your recipient can read
- Digital treasure hunt—leave clues that lead people to the username and password that decrypts a BitNote account and reveals a prize.
- Private Journal—use BitNote as a diary that you can optionally pass down to future generations.
- Will—write a digital copy of your will to be passed down automatically.
- Digital time capsule—create messages or store information intended to be accessed or opened far into the future.

Ultimately BitNote allows you to self-custody information, in a similar way that blockchains let you self-custody money.

With the addition of our “succession” feature, being able to store secrets safely for extended periods of time and passed down to appropriate beneficiaries becomes possible in a decentralized, permissionless, censorship resistant manner.

How does it work?

Your data is not recorded by BitNote in any way. Your data is securely encrypted before it ever leaves your computer to be submitted on-chain. The BitNote website communicates directly with the smart contract, there is no intermediary or backend. We do not have any analytics or third party trackers on the BitNote app whatsoever.

After tapping sign up, you’ll be asked to create a unique username. Then you'll be presented with options on how you'd like to secure your account (either master password or security key). You’ll also be asked to fund your account to register your username and create notes. You can pay using crypto, credit or debit card. You DO NOT need a web3 wallet like metamask to use BitNote.

BitNote is a “pay as you go” system. No subscriptions or recurring fees. You pay only to create/edit/delete notes, and viewing notes is free.

To access your encrypted notes, just sign into the BitNote website, then tap on a particular note to decrypt and view its contents.

How much does it cost?

For BitNote there are no subscriptions or ongoing fees. You pay just once to save a note and viewing a note is free.

It varies depending on what the current fee is to save data to the blockchain (called the “gas fee”) and how long your note is. As of the time of this writing, it costs a few cents to publish a short note on our default blockchain (Avalanche), and a few dollars for a very long note.

How does BitNote make money?

A small portion of the fee to publish a note goes back to fund the development of BitNote (the rest goes to pay the blockchain to store your note). This ensures that BitNote’s incentives are aligned with its users, and that BitNote only makes money when people use the product, unlike subscription services.

Can you edit or delete a note?

Yes. Notes can be edited or deleted after they’ve been created. You would just need to pay a fee to do so, as you are making a change directly on the blockchain.

What blockchains are supported?

At launch we’ll support Avalanche, but other chains may be supported in the future based on demand.

How does the encryption work?

BitNote is end-to-end encrypted and zero knowledge. All encryption happens locally on your machine, and no one can see your data besides you.

After a user selects a username and master password, an account is generated with a secp256k1 key pair, EVM public address, and an ECDH p-521 key pair which is used for encrypting notes.

The master password is used to derive a key with pbkdf2-sha512 set to 1 million iterations, which is then used to encrypt the two private keys with AES-GCM using the outputted 256-bit key.

With the user’s public address as the index, the two private keys are encrypted on the blockchain, as well as the ECDH public key.

The username is hashed with keccak256 and the resulting hash is used as an index that points to the public address.

When the user logs into BitNote, the keys are retrieved, decrypted client side, and the ECDH key pair are utilized to decrypt the notes.

For additional security, all the client side computation is handled within a web worker.

Is BitNote Audited?

Yes. BitNote has been audited by Cure53.

Summary of the Audit

Audit Report

Is BitNote open source?

Under the BSL 1.1 license, BitNote is technically "source-available" at the moment. This means the code is publicly available to scrutinize, but is prohibited from being used in production — without explicit approval from us (which, in general, we are happy to give). On May 1st, 2028 BitNote will automatically transition to a GNU General Public License v3.0. On this date, BitNote will be fully open source.

How is BitNote built to last?

BitNote is built with simple, time tested technology: HTML, CSS, and Javascript. No frameworks. The entire app comes in well under 1MB in total size. It’s designed to have very few dependencies and be resilient for many years to come––a "forever machine."

What happens if BitNote disappears?

Your data is stored on the blockchain, not on BitNote. The BitNote website allows you to easily access your data on the blockchain, but there are multiple ways to do that if BitNote disappears.

The easiest way is to download and use the local version of BitNote (available through the browser install icon in the address bar). This will allow you to run the software on your computer or phone, without needing to rely on the website.

Even if the website goes down and you don’t have a local copy of the software, you can always communicate with the smart contracts directly and access your data. Also, because BitNote is open source, other people can create similar front end websites based on our code fairly easily, allowing further redundancy.

Ultimately our goal is to make BitNote as decentralized as possible so that there are no single points of failure.

How important is it to choose a strong password?

Very, very important. Your data is stored encrypted, but publicly. It will exist not only on a public blockchain, but also archival nodes and even blockchain explorers. Which is great for redundancy. There will be many copies of your encrypted data. But the downside is if you choose a weak password the encryption can be broken, and your data will be compromised. So please choose a strong password. Or better yet, use a security key instead of a user-generated password.

How is password strength estimated?

When you create a BitNote account you’ll be asked to setup a master password to keep your data safe. We estimate your password strength with a “cost to crack” calculation that estimates how much an attacker would have to spend in compute resources to brute force your password.

We use the open source (and well regarded) zxcvbn to calculate password entropy, which we then adjust for the number of iterations we are using in PBKDF2 to generate the total search space an attacker would have to search to successfully brute force a password. On average, an attacker would need to guess half the total search space to crack a password, and we estimate what it would cost an attacker to do that based on past crack competitions. We also account for compute speed increases over time, assuming that computation power doubles every eighteen months.

How safe is BitNote?

Very safe. We are using incredibly strong encryption (“military grade,” “bank level,” “zero knowledge encryption”). AES-256 itself is authorized for use for the US government’s transmission of top secret information.

But any system is only as secure as its trust assumptions. BitNote is safe assuming:
1. You choose a strong password
2. You store and access your password safely
3. The device you’re using BitNote on isn’t compromised

There are additional long tail risks to be aware of:
1. The blockchain you are storing data on doesn’t disappear
2. The method you’re using to access BitNote (like the front end website) isn’t compromised
3. AES-256 encryption doesn’t get meaningfully cracked

Aren’t quantum computers going to wreck encryption?

AES-256 is considered quantum resistant as long as your password contains at least 256 bits of entropy. Of course no one can exactly predict the future, but there are good reasons to believe AES-256 will keep your secrets safe for the long run.

Who is the team behind BitNote?

BitNote was created by an independent team, led by Rockwell Shah. You can find an interview discussing the protocol on YouTube.

In general we believe that crypto infrastructure can be really powerful, but most uses that we've seen of blockchains today are not aligned with our values. We're interested in building actually useful things that deliver real value and solve real problems.

Why Bitnote?

Protect Your Secrets. Forever.

What People Say

Why Bitnote

Private & Secure

No Subs

Decentralized

Audited

Permissionless

Open Source

Distributed

Succession

Referrals

How it Works

Demo

Screenshots

Open Source Contributions

Demo

More Features

Open Source Contributions

Frequently Asked Questions

Keep Your Secrets Safe