End-to-end encrypted
Pages, titles, secrets, and attachments are encrypted in the browser. The server only stores ciphertext and never sees your passphrase.
bqNotes
- Zero-knowledge server
- No shared passphrases
- Every version kept
End-to-end encrypted · free trial on every plan
The encrypted notebook an infrastructure team actually wants.
Runbooks, server notes, secrets, and network records in one shared workspace. Pages are encrypted in the browser, every edit is versioned, and the server stores ciphertext — never plaintext.
Zero-knowledge server
No shared passphrases
Every version kept
What infrastructure teams keep in one place
Purpose-built for the notes ops teams actually write, with encryption that does not trust the server.
Per-user key delivery
Invite teammates without sharing a vault passphrase. Each member unwraps the team key from a one-time invite link and re-wraps it under their own passphrase.
Full version history
Every edit is an encrypted snapshot with author and timestamp. Preview any version and restore it in one click. Restoring never destroys history.
Teams and workspaces
Organize by team, then by workspace. Members, roles, and workspaces are managed from an admin console. One person can belong to many teams.
Secrets, with an audit log
Store passwords and tokens as encrypted secret blocks. Reveal or copy only when needed — each reveal and copy is written to the audit log.
Encrypted attachments
Diagrams, configs, and exports are encrypted before upload and decrypted only in the browser. Object storage holds ciphertext.
Blocks for ops work
Beyond rich text: code and command blocks, .env values, a TLS certificate tracker, a subnet calculator, server facts, and Mermaid diagrams.
AES-GCM in the browser
A per-team root key is generated and unlocked in the browser. Page, secret, and attachment keys are wrapped beneath it. The server keeps metadata, ciphertext, and encrypted key envelopes.
Up and running in three steps
01
Pick a plan and sign up
Choose a plan, a workspace address, and a currency. Confirm the email link and the workspace is ready.
02
Create the team vault
Set up the first admin, generate the team root key in the browser, and lock it with a passphrase only you hold.
03
Invite the team
Send keyed invite links. Teammates set their own passphrase. The shared one is never handed out.
Simple plans, every one with a free trial
Unlimited workspaces on every plan. Prices below are monthly in USD. Yearly billing saves 10%. AUD and BDT are available on the bqNotes site.
Solo
$2.50/ month
One team, one member, unlimited workspaces.
- 1 team
- 1 member
- Unlimited workspaces and pages
- 14-day free trial
Corporate
$8.33/ month
Up to three teams and ten members.
- 3 teams
- 10 members
- Unlimited workspaces and pages
- 14-day free trial
Enterprise
$20.83/ month
Unlimited teams, up to 25 members.
- Unlimited teams
- 25 members
- Unlimited workspaces and pages
- 14-day free trial
Need a larger team or custom billing? Contact Binary Quest.
Desktop app and trial
The same encrypted workspace in its own window. It connects to a bqNotes workspace hosted by Binary Quest or on your own server, and you sign in through the browser.
Windows is coming soon. The Mac app is signed and notarized, keeps itself up to date, can unlock with Touch ID, and locks when the Mac sleeps or the screen locks. You need a bqNotes workspace to sign in.
Questions
Does the server see my notes?
No. Encryption happens in the browser. The server persists ciphertext and encrypted key envelopes, not plaintext or your passphrase.
Do teammates share one vault password?
No. Each person sets their own passphrase. Invite links deliver the team key without handing out a shared passphrase.
Where do I download the desktop app?
The Mac build is a signed DMG for Apple silicon and Intel, on macOS 11 or later. Windows is not available yet.