SafeNotes - YubiKey Vault

SafeNotes is an encrypted notepad and secrets vault for Android, unlocked by a YubiKey hardware security key over NFC. No master password to remember, no cloud account, no way in without the physical key. Everything stays on your device.

HOW IT WORKS
Your vault is encrypted with AES-256-GCM. The encryption key is derived from your YubiKey's HMAC-SHA1 challenge-response and never exists on disk — only in memory while the vault is open. Tap your YubiKey to unlock. The vault locks automatically after inactivity or when you switch apps.

Steal the phone, the data is useless. Steal the YubiKey, you don't know which phone it unlocks. You need both physical objects, together, at the same time.

THREE VAULT MODES
- YubiKey only
- YubiKey + PIN — true two-factor unlock
- YubiKey + PIN with biometric shortcut for faster re-unlock

The YubiKey is always required. When unlock fails, the app cannot tell you whether the YubiKey or the PIN was wrong — the encryption key is derived from the combination of both, so the two factors are mathematically inseparable.

WHY SAFENOTES
- No cloud — everything stays on your device, encrypted at rest
- No account — no registration, no email, no remote recovery
- No tracking — zero analytics, zero ads, zero network calls

WHAT TO STORE
SafeNotes goes beyond a typical password manager. Alongside passwords and codes, you can keep encrypted documents, photos and voice memos in the same vault — things most password managers can't hold at all.

- Scans of IDs, passports, contracts, certificates
- Photos of sensitive documents or whiteboards
- Voice memos with private information
- Recovery codes (Google, Apple, banks, social accounts)
- Crypto seed phrases and wallet keys
- 2FA / TOTP secrets (built-in authenticator)
- PINs, PUKs, server credentials, API keys
- Anything you don't want on a cloud-synced note app

BUILT-IN TOTP AUTHENTICATOR
Login notes can hold a TOTP secret with a live 6-digit code and countdown timer, exactly like a dedicated authenticator app. Add codes by scanning an otpauth:// QR or pasting the base32 secret manually. Your second factors live inside the same encrypted vault as the account they belong to.

ATTACHMENTS
- Multiple attachments per note: documents, photos, voice memos
- Full-screen photo viewer, inline audio player with scrubber
- Everything stays inside the encrypted vault — no cleartext on disk
- Lock is suspended during recording and file pickers, so the vault doesn't close mid-task

ORGANIZATION
- 7 categories (Personal, Work, Finance, Crypto, Health, Credentials, Other)
- Full-text search across all notes
- Pin important notes to the top
- Smart category filter
- Two-tab home with bottom navigation
- One-tap copy to clipboard

BACKUP & RESTORE
- Encrypted backup export (format v3, includes attachments)
- The backup file is useless without your YubiKey
- Restore from backup at first launch on a new device
- Imported vaults safely downgrade biometric shortcut to PIN until re-enrolled

PRO FEATURES (optional one-time purchase)
- Auto-destroy the vault after a configurable number of failed unlock attempts
- Persistent failure counter that survives reinstalls
- Encrypted audit log of unlocks, edits and exports, grouped by day
- Graceful degradation if PRO is later revoked — your data is never held hostage

REQUIREMENTS
- Android device with NFC
- A YubiKey with HMAC-SHA1 Challenge-Response configured on Slot 2 (YubiKey 5 series recommended)

SETUP YOUR YUBIKEY
1. Open YubiKey Manager
2. Applications → OTP → Slot 2 → Configure
3. Select Challenge-Response → HMAC-SHA1
4. Generate a secret key
5. Open SafeNotes and tap your YubiKey to create the vault

SECURITY NOTE
If you lose your YubiKey and have no backup, your notes are permanently inaccessible. This is by design. We recommend configuring two YubiKeys with the same HMAC-SHA1 secret as a backup.