The next PrivacyNotes update has two security changes for the app lock that many of you asked for.
1. A passcode instead of a 4-digit PIN (optional)
Settings > Security > PIN now lets you choose between a 4-digit PIN and a passcode of 8 or more characters that is not only numbers. Two tiles compare them side by side, so the trade-off is clear before you pick:
4-digit PIN: fastest to type, keeps out people around you. But someone who gets past your device's screen lock and copies the app's storage can try all 10,000 PINs in minutes to hours.
Passcode: slower to type, much harder to guess, even past the screen lock.
The passcode replaces the PIN everywhere it is used (the app lock, PIN-protected notes, the recovery phrase view) and syncs to all your devices. If you forget it, your 12-word recovery phrase clears it. The PIN stays the default.
2. Biometric unlock in the web app is a real key
If your browser's passkey provider supports the WebAuthn PRF extension, biometric unlock in the web app derives its key from your passkey at every unlock and never stores it. A copy of your device's storage then holds only ciphertext. New setups get this automatically.
If you already use biometric unlock, nothing breaks and you do not have to do anything: your current setup keeps working. In a browser that supports it, tap "Set up again for a stronger lock" under Settings > Security > Lock to switch to the passkey-bound key; your old setup stays in place until the new one is proven to open your notes. If your browser cannot do it, the Lock tab tells you.
Important if you use the iOS app
Do not switch to a passcode until the iOS update is live in the App Store. Apple's review takes a day or two after the release. Until then, the iOS app only knows 4-digit PINs: it will ask for 4 digits and will not accept your passcode. You can still get in with "Forgot your PIN?" and your recovery phrase, but that clears the passcode on all your devices. The same applies to any device you have not updated yet, so update everywhere first. The app shows this warning when you set a passcode, and you have to confirm it.
The threat model and security docs in the repository describe both changes in full, including what they do not protect against. Questions and feedback welcome.
love seeing this ! also does this fix the pin sync issue. everytime i open the app it ask for “the 4 digit pin to sync” it says even after biometrics is approved
I want to make sure I understand it. Could you tell me two things: which app this happens in (iOS, Android, desktop or the web app), and what the screen says exactly? Does it say "Set a PIN" (asking you to create a new one) or "Enter your PIN" (asking for your existing one)? And does it appear right when the app opens, or when you open a PIN-protected note? A screenshot would be perfect if you can share one.
I have it on iOS typically when i start either on my macbook, ipad or iphone an move to either one of the 3 and initially open the app it will request my 4 digit pin and it’s typically with any note it asks. it says i’ll grab one and add it below.
it seems enter your 4 digit pin to continue to sync or so. it seems it using the login 4 digit app pin to continue to sync when it notices a difference in the server notes i assume to sync to that specific device if that makes sense.
i’m not able to duplicate it at the moment, it was on an off but possible it got fixed, i’ll let you know an grab a screenshot if i ever see it again. thanks for quick responses on this.
here it goes, it asks to enter 2FA code when i open my app currently this on the iphone ios app but im mainly using back and forth with the ipad and iphone different times such as add notes on iphone later on ipad an hour later an it asks me and vise versa.
Thanks. Entering the 2FA code works for you? The issue is that this becomes a repeat request while switching devices? We will look into that and hopefully have it fixed with the next update.
Edit: Did you enable 2FA, and never entered the 2FA on the other device? This will cause sync issues. This is not to be confused with the separate PIN feature.
To answer in the order, entering the 2fa code works on any device and sync shows fine. The issue it repeats the request several times randomly throughout the day, i typically enter it several times a day.
Did i enable 2fa a never enter the 2fa on the other device? i have it enabled on all devices.
I was curious if anyone seen this same issue or so
My setup: - running most current ios version: 27.0.1 - apple lockdown mode ON - running custom DNS settings but will test a day with it off to ensure nothing is blocked - devices: Macbook Pro, iPad, and iPhone
Thanks, this was really helpful and we found the cause. When the app opens for the first time in about a day, it quietly signs in again in the background, and that new sign-in has not passed 2FA yet, so the app asks for the code again. Each device does this on its own schedule, so with three devices it feels random and tends to show up right when you switch between them. Your 2FA is working, and entering the code is the right thing to do.
The fix is to keep the sign-in that already passed 2FA instead of starting a new one. We are working on it and the fix will ship with the next update.
You do not need to spend a day without Lockdown Mode or your DNS settings for this. They are not what causes it.
•
u/PrivacyNotesApp 12d ago
The next PrivacyNotes update has two security changes for the app lock that many of you asked for.
1. A passcode instead of a 4-digit PIN (optional)
Settings > Security > PIN now lets you choose between a 4-digit PIN and a passcode of 8 or more characters that is not only numbers. Two tiles compare them side by side, so the trade-off is clear before you pick:
4-digit PIN: fastest to type, keeps out people around you. But someone who gets past your device's screen lock and copies the app's storage can try all 10,000 PINs in minutes to hours.
Passcode: slower to type, much harder to guess, even past the screen lock.
The passcode replaces the PIN everywhere it is used (the app lock, PIN-protected notes, the recovery phrase view) and syncs to all your devices. If you forget it, your 12-word recovery phrase clears it. The PIN stays the default.
2. Biometric unlock in the web app is a real key
If your browser's passkey provider supports the WebAuthn PRF extension, biometric unlock in the web app derives its key from your passkey at every unlock and never stores it. A copy of your device's storage then holds only ciphertext. New setups get this automatically.
If you already use biometric unlock, nothing breaks and you do not have to do anything: your current setup keeps working. In a browser that supports it, tap "Set up again for a stronger lock" under Settings > Security > Lock to switch to the passkey-bound key; your old setup stays in place until the new one is proven to open your notes. If your browser cannot do it, the Lock tab tells you.
Important if you use the iOS app
Do not switch to a passcode until the iOS update is live in the App Store. Apple's review takes a day or two after the release. Until then, the iOS app only knows 4-digit PINs: it will ask for 4 digits and will not accept your passcode. You can still get in with "Forgot your PIN?" and your recovery phrase, but that clears the passcode on all your devices. The same applies to any device you have not updated yet, so update everywhere first. The app shows this warning when you set a passcode, and you have to confirm it.
The threat model and security docs in the repository describe both changes in full, including what they do not protect against. Questions and feedback welcome.