“Password protected” is doing a lot of work in app store listings. In many notes apps it means a lock screen in front of a plain-text file: convenient, and useless the moment someone opens the file another way. If a note is worth a password, it is worth encrypting.
What Dash locks, and how
- Lock a single note. Give any note its own password. The content is encrypted with AES-256-GCM using a key derived from that password with PBKDF2-SHA256 (600,000 iterations). Nothing about the note is readable on disk.
- Lock the whole app. Turn on App Lock and every note is protected behind a master password. Dash locks itself after 1, 5, 15 or 30 minutes of inactivity, a custom interval, or on demand with Cmd+Shift+L on Mac.
- Unlock with Face ID or Touch ID. Biometrics on iPhone and Mac unlock the app or an individual note; your password stays as the fallback.
- Add a duress password. A second password that opens a decoy set of notes while your real data stays encrypted, for the rare situation where you are forced to unlock.
- Let notes delete themselves. A self-destruct timer removes a note after an hour, a day, a week or a month, with a countdown so you know when.
All of it works offline, with no account. Dash is open source, so the encryption code is there for anyone to read.