NotepadCrypt

User Documentation

(updated 4/2007)
NotepadCrypt is a simple text editor based on Notepad2 with the added option of encrypting the contents of the files it edits. Except when opening and saving files, refer to Notepad2's documention. Nothing has been changed. If you read or write unencrypted files, nothing has been changed. If you open an encrypted file, NotepadCrypt will prompt you for the passphrase. When you save a new version of the file, it will be automatically encrypted using the same passphrase. There is one new item on the file menu, "Set Encryption PassPhrase" which will let you change or remove the encryption.

Like Notepad2, NotepadCrypt is a single small binary file which requires no installation. Just put it anwhere you want and run it. (hint: keep a copy of notepadcrypt on your flash drive, along with a copy of your encrypted files).

In my mind, the biggest problem with encrypting your data is that if you forget your passphrase, either your data is really permanantly lost or else the encryption wasn't very good to begin with!. NotepadCrypt addresses this problem by allowing an additional master passphrase as a method of emergency data recovery in case you have lost of forgotten your passphrase.

NotepadCrypt uses well established, standards based techniques to encrypt its data, and it is open source, so you can be reasonably confident that the encryption method it uses is secure and there are no secret trapdoors. The buzzword description of the encryption is "256 bit AES". If you're interested in the details, or the source code, check the technical information page.

Current version, based on Notepad2 version 2.0.15
    Download NotepadCrypt (windows GUI text editor)
Archival version, based on Notepad2 version 1.0.12
    Download NotepadCrypt (windows GUI text editor)
Unchanged, same for either version of NotepadCrypt
    Download NotepadCryptCl   (command line encryption utility using the same file format)

Advice about pass phrases, data security, and NotepadCrypt

First, think of pass phrases rather than passwords. Any password that is short and simple enough to remember CAN be cracked by a program running on modern hardware for a few days. So use a longer phrase which will be easy to remember but not possible to guess.
Each file should have it's own pass phrase, and that pass phrase should change once in a while. The problem this strategy addresses is shit happens. Things will happen that accidentally reveal your pass phrase (someone was watching over your shoulder) or you are forced to give up your passphrase for good reason (your girlfriends phone number is on your computer at work, and you need your buddy to read it to you over the phone). When these things inevitably occur, you don't want all of your other encrypted files to be compromised too!
Use a master passphrase that you will never forget. Never tell it to anyone or write it down. Don't use it routinely - try hard to always use the regular passphrase. The master passphrase is your insurance policy against forgetting or losing the phrase for any particular file.
Think about overall security, not just the passphrase. While this encryption scheme uses high quality AES encryption and quite long 256 bit keys, that is almost irrelevant to the overall security. It's like having a very expensive lock on your front door. Thieves won't go to great lengths to pick your lock; they will simply break a window instead. The weak link in this encryption scheme is YOU and your selection of pass phrases. If your encrypted files are compromised, the most likely methods are the simple and obvious ones (1) they ask, you tell. or (2) they find the scrap of paper where you wrote the passphrase or (3) some keystroke logging program watches you type the passphrase.
Finally, consider the suitablility of this encryption scheme for your purpose.
- If your goal is to prevent your wife from reading your girlfriend's phone number in your address book: definitely ok.
- If your goal is to prevent disclosure of sensitive data if your laptop is stolen: most likely ok.
- If your goal is to prevent fishing by the IRS, should they ever become curious about you: don't count on it. They'll throw you in jail until you tell them the password, or install a key logger and wait for you to tell them voluntarily.
- If your goal is to keep secrets from people who are definitely out to get you, and are willing to shove bamboo splints under your fingernails until you talk: don't even think about it.