NOTESME.
Your notes. Your server. Your rules.
A lightweight, encrypted note-taking app that deploys in one command. Zero tracking. Zero cloud dependency. Total control.
Up and running
in 60 seconds.
No complex setup. No configuration headaches. Just your notes, on your server.
Pull the image
One single Docker image. That's all you need. Run docker pull ghcr.io/stban1983/notesme:latest and you're halfway there.
Configure your .env
Set your username, password, and optionally generate an encryption key for AES note encryption. That's 3 environment variables — done.
Launch & write
Run docker compose up -d and open your browser. Your private, encrypted note-taking app is live. Install it as a PWA on your phone for native-app feel.
Everything you need.
Nothing you don't.
Built for people who want a clean, fast, and private note-taking experience without the bloat.
AES Encryption at Rest
Notes are encrypted with Fernet (AES-128-CBC + HMAC-SHA256) before hitting the database. Without your key, data is unreadable.
Rich WYSIWYG Editor
Bold, italic, headings, code blocks, checklists, drag & drop images — a full editor with zero framework overhead.
Version History
Automatic snapshots every 5 minutes, up to 50 versions per note. Roll back to any point in time with a single click.
Unlimited Folders
Nest folders and subfolders however you like. Pin important notes, soft-delete to trash with auto-purge, and export to .txt or .html.
PWA & Offline
Installable as a native app on any device. Works offline in read-only mode. Share content from other apps directly into NotesMe.
Multi-User Ready
Admin panel with full user management. Each user gets complete data isolation — notes, folders, and trash are totally private.
Your data stays
your data.
We built NotesMe with a security-first mindset. No shortcuts, no excuses.
Argon2id Password Hashing
OWASP 2024 recommended algorithm. Brute-force resistant by design.
XSS Protection (Dual Layer)
DOMPurify on the frontend, html.escape() on the server. Both layers, always.
In-Memory Search
Decrypted content never touches the disk. Full-text search runs entirely in memory.
Rate Limiting & Path Traversal Guards
Brute-force protection on login. SVG uploads banned. All file paths validated.
Lightweight. No bloat.
Take back control of
your notes.
Open source, MIT licensed, forever free. Deploy on your NAS, your VPS, or your Raspberry Pi. It's yours.
MIT License · No telemetry · No vendor lock-in