Show HN: Unforget, the note-taking app I always wanted: offline first, encrypted

Original Article ↗ Hacker News Discussion ↗

An open-source note-taking app called Unforget—built as an offline-first, end-to-end encrypted PWA—prompts comparisons with tools like Google Keep, Joplin, Obsidian and Apple Notes, and raises questions about its workflow, organization model, and platform support. Commenters probe its security model (local plaintext storage, password hashing, and encryption), limitations of browser storage and service workers, and the trade-offs of PWAs versus native or Electron apps for performance, distribution, and integration. The creator explains design choices such as simple chronological notes with search instead of folders, reliance on IndexedDB and a SQLite-backed sync server, self-hosting options, and potential future features like more importers, themes, and WYSIWYG or org-mode support.

App concept & workflow

  • App is an offline‑first, encrypted, self‑hostable note‑taking PWA inspired by Google Keep.
  • Notes are small, free‑form markdown documents; typically one idea per note, but can grow arbitrarily large.
  • Notes are displayed in a single chronological list, with:
    • Pinned notes floating to the top (toggleable).
    • Archived notes accessible via main menu.
  • No true tag system or folders; users simulate tags with #tag strings and rely on fast substring search.
  • Titles are inferred from markdown # headers or the first line.

Offline‑first PWA & tech stack

  • Offline capability relies on service workers and IndexedDB (not localStorage), so it fails in browsers or modes that block service workers (e.g., private/Incognito, Tor).
  • Distributed as a PWA, installable on mobile (and via “save to dock” on newer macOS Safari).
  • Author chose web stack for cross‑platform reach, easy distribution, and avoiding app stores; some commenters prefer native/Qt/GTK or desktop apps for clearer data control and performance.

Sync, security & privacy

  • Sync requires sign‑up because a server is used; self‑hosting is supported via the open‑source repo.
  • Notes are end‑to‑end encrypted on the server; clients see encrypted “gibberish” over the network.
  • On client devices, notes are stored in plaintext in IndexedDB for usability (no constant re‑auth).
  • Password handling uses hashing plus salts and PBKDF2 for encryption; initial critique highlighted weak server‑side password‑hashing choices and predictable salt, and the author agreed to strengthen this.
  • Threat model is mostly “don’t trust the server or large companies,” not “protect from other users on same device.”

Feature requests & UX feedback

  • Requests: regex search, more robust heading collapse/expand (org‑mode‑like), themes, WYSIWYG markdown editor, Mermaid diagrams, drawings, image support, improved onboarding, and a “how it works” explanation.
  • Some users like the minimal organization and keyboard‑first capture; others miss folders, ordering, and rich media.
  • Minor UI bugs/typos and Firefox layout issues are reported.

Comparisons & alternatives

  • Compared with NotesNook, Joplin, Obsidian, Apple Notes, Zettel Notes, Omnivore, Diary, SilverBullet, etc.
  • Debates around PWA vs Electron vs native:
    • Some argue people prefer “real apps” even if Electron‑based.
    • Others value PWAs for minimalism, open source, no Electron bloat, and easy installation.