Joplin vs Filarr: Two Encrypted Note Apps, Two Very Different Bets

Quick answer: Joplin and Filarr both let you keep notes that nobody else can read, but they get there from opposite directions. Joplin is a mature, AGPL-licensed, Markdown-first note app where encryption is a switch you flip on top of a cloud sync you choose (Dropbox, Nextcloud, S3, or Joplin Cloud), and where end-to-end encryption is powerful but off by default. Filarr is a local-first encrypted workspace where every file is sealed with AES-256-GCM on your disk from the very first save, notes and arbitrary files live side by side with a graph that links them, and cloud sync is an optional add-on rather than the foundation. If you want a battle-tested, plugin-rich Markdown notebook and you're willing to turn encryption on yourself, pick Joplin. If you want encryption that's the default, covers files as well as notes, and treats the cloud as merely a follower, look at Filarr.

The comparison nobody set up fairly

Most "encrypted note app" comparisons are built to make one product look like a unicorn and everything else look like a toy. I'm not going to do that, partly because I built Filarr and a rigged comparison would insult you, and partly because Joplin genuinely doesn't deserve it. Joplin is one of the few projects in this space that has been around long enough, and stayed honest enough, that it earned a real reputation rather than a marketing one. It's open source, it syncs to storage you already own, and it has end-to-end encryption that, when you turn it on, actually works. So this isn't a hatchet job. It's an attempt to map two products that share a value — your notes are yours and nobody else should be able to read them — onto the very different architectures they each chose to deliver it.

The tension worth naming up front is that "encrypted" is doing an enormous amount of work in both products' descriptions, and it means subtly different things in each. In Joplin, encryption is a transport and storage protection you enable so that whatever cloud you sync through can't read your notes. In Filarr, encryption is the format your data is stored in, locally, whether or not any cloud is involved. That difference sounds academic until you trace it through every scenario that matters: what happens when your laptop is stolen, what happens before you've turned anything on, what happens when the sync server is compromised, and what happens to the files that aren't notes. By the end of this, you should be able to predict each app's behavior in those situations without me telling you, which is the only kind of comparison worth reading.

There's also a timing reason this comparison matters in 2026 specifically. The note-app world spent a decade optimizing for collaboration and cloud convenience — Notion, Google Docs, the whole shared-cursor era — and the bill for that convenience is now arriving in the form of breaches, subpoenas, training-data scraping, and the slow realization that "the cloud" means "someone else's computer reading your diary." Both Joplin and Filarr are reactions to that, but Joplin is the reaction that grew up inside the old world and added privacy as a layer, while Filarr is the reaction that started from privacy and added everything else on top. Neither approach is wrong. They're just different bets about what the default should be, and defaults, as anyone who has shipped software knows, are the most powerful product decision you ever make.

Where each of these came from

Joplin's history is the kind of open-source origin story that ages well. Laurent Cozic started it around 2016, and the first command-line version shipped on 12 July 2017, with Android following weeks later and the desktop app arriving that November. It was never a venture-funded land grab; it grew the way durable open-source tools grow, through a creator scratching his own itch, a Patreon and later a modest paid cloud service to keep the lights on, and a community that contributed plugins, translations, and bug reports for the better part of a decade. The license is AGPL-3.0, which is a deliberate and meaningful choice I'll come back to, and the codebase is genuinely open in the way that matters: you can read it, fork it, audit the encryption, and self-host the sync server without asking anyone's permission. That longevity is Joplin's single biggest asset. Software that has survived eight-plus years of real users storing real data has been through fire drills that newer apps simply haven't faced yet.

Filarr is the newer entrant, and I won't pretend otherwise — it's a 2026-era product, which means it carries all the advantages and all the liabilities of being young. The advantage is that it was designed after the cloud-privacy reckoning rather than before it, so it didn't have to retrofit encryption onto an architecture that assumed a trusted server. The liability is exactly what you'd expect: a smaller community, fewer third-party extensions, a mobile story that's still in progress, and none of the battle-scars that only time provides. I built Filarr around a specific frustration that Joplin, for all its strengths, doesn't fully address — the fact that my notes and my actual files lived in two separate universes, and that the privacy I wanted for my notes I also wanted for the PDFs, images, and documents that the notes referred to. So Filarr's origin isn't "build a better Joplin." It's "build the encrypted workspace where notes and files are first-class citizens of the same encrypted space, and where I never have to remember to turn the encryption on."

Those two origin stories explain almost every concrete difference you'll hit later. Joplin's center of gravity is the note — a Markdown document, syncable, taggable, clippable from the web — and everything else orbits it. Filarr's center of gravity is the encrypted file on your disk, of which a note is simply one type, sitting next to the 51-plus other file formats it knows how to handle, all linked together in a graph. When you understand that one product grew outward from the note and the other grew outward from the encrypted file, the rest stops being a list of features and starts being two coherent worldviews. And worldviews, not feature checklists, are what you're actually choosing between.

The philosophical fork: opt-in privacy vs. privacy-by-default

Here is the fracture that everything else rests on, and it's worth slowing down for. Joplin is offline-capable and local-first in the sense that your notes live in a local database and the app works without a connection, which is real and valuable. But its end-to-end encryption is opt-in: when you set Joplin up, your notes are stored locally in a database that is not itself encrypted by E2EE, and to make sync zero-knowledge you go into the Encryption Configuration screen and explicitly enable it on one device, then propagate that to the others. This is not a criticism of the implementation — Joplin's docs are clear and honest about this, and the reasoning is defensible, because E2EE adds complexity and recovery risk that not every user wants. But the consequence is unavoidable: there is a window, and for many users it's a permanent window, in which Joplin's data protection depends on you having flipped a switch you may not have known was there.

Filarr makes the opposite bet, and it's the bet the whole product is built around. Encryption isn't a mode; it's the storage format. Every file Filarr writes to your disk is sealed with AES-256-GCM before it touches the filesystem, with a per-file encryption key, from the first save, with no configuration screen to find and no switch to forget. There's no "enable encryption" button because there's no state in which encryption is off. The cloud, in Filarr's design, genuinely "only follows" — sync is an optional capability layered on top of data that is already encrypted at rest locally, rather than the thing that triggers encryption. If you never turn sync on, you still get full at-rest encryption. That inversion — encryption as the floor rather than the ceiling — is the single most important thing to understand about why these two products feel different in daily use even when they look similar on a spec sheet.

Let me make this concrete with a scenario, because abstractions about defaults are easy to nod along to and hard to feel. Imagine two people, Anna and Ben, who each install one of these apps on a Friday evening, jot down a few sensitive notes — a therapy reflection, a draft resignation letter, a list of account numbers — and then go to bed without touching any settings. Anna used Joplin. Her notes are saved in Joplin's local database; if she never opened the encryption configuration, those notes are sitting in local storage in a form that someone with access to her unlocked, running machine or her unencrypted disk could read, and if she later turned on a cloud sync without enabling E2EE, they'd traverse and rest on that provider readable. Ben used Filarr. His notes were sealed with AES-256-GCM the instant he saved them, on disk, before he configured anything, because that's the only way Filarr writes data. Neither Anna nor Ben did anything wrong. They behaved identically. The difference in their exposure comes entirely from which product decided that the safe state should be the default state. That's the philosophical fork, and it's not a small one.

None of this means Joplin is insecure — turn its E2EE on and rely on full-disk encryption for the local database, and you have a genuinely strong setup. It means the two products place the burden of safety in different places. Joplin trusts you to opt in and to layer OS-level disk encryption underneath; Filarr removes the opt-in step and makes at-rest encryption non-negotiable. Which of those is "better" depends entirely on whether you'd rather have control with responsibility or safety with less ceremony, and reasonable people land on both sides.

What each tool is actually for

It would be a mistake to treat these as interchangeable apps that happen to differ on encryption, because their core purpose diverges. Joplin is, at its heart, a Markdown note and to-do application with synchronization. That's the thing it does supremely well: you write notes in Markdown, you organize them into notebooks and tags, you set to-dos, you clip articles from the web with the official browser extension, and you sync the whole corpus across your devices through whatever backend you trust. The Markdown-first design is not incidental; it's a philosophy that says your notes should be plain, portable, future-proof text that will outlive the app itself. If Joplin vanished tomorrow, your exported Markdown would still open in any editor on earth. For people whose mental model of knowledge work is "a large, searchable, interlinked pile of text documents," Joplin is close to ideal, and its eight years of refinement on exactly that workflow show.

Filarr is aiming at a broader and messier target: the whole workspace, not just the note pile. The premise is that real knowledge work isn't only Markdown — it's the PDF of the contract, the screenshot of the error, the spreadsheet, the design mockup, the voice memo, and the notes that tie all of those together. Filarr handles 51-plus file formats as first-class encrypted objects, so the contract PDF and the note analyzing it live in the same encrypted space, and the graph view lets you see and traverse the relationships between notes and files rather than treating files as second-class attachments. Workspaces with multiple profiles let you keep, say, your client work and your personal vault as genuinely separate encrypted contexts. The design goal is that the thing you protect and organize is your work, in all its file-type heterogeneity, not just the subset of it that happens to be Markdown text.

This is why a head-to-head on "which is the better note app" slightly misses the point. If your need is purely textual note-taking with rock-solid sync and a deep plugin ecosystem, Joplin is arguably the more focused, more mature tool, and I'd be lying if I said otherwise. If your need is an encrypted home for the full range of stuff you work with — notes plus files plus the connections between them — then Filarr is solving a problem Joplin doesn't really try to solve, because attachments in Joplin are tethered to notes rather than being independent citizens of the workspace. Choosing between them starts with an honest answer to a simple question: are you protecting a notebook, or are you protecting a workspace? Get that right and the rest of the decision mostly makes itself.

Encryption, all the way down

Let's get specific, because "both are encrypted" is where lazy comparisons stop and useful ones begin. Joplin's end-to-end encryption, in its modern form introduced around version 3.2, uses AES-256-GCM as the cipher for its newer encryption methods, having moved up from the older AES-256-CCM method used previously. The scheme centers on a randomly generated 256-byte master key; a fresh salt is used per encryption operation to derive a new key from the master key for each item, which neatly sidesteps the short-IV reuse problem that naive AES-GCM usage can fall into. The master key itself is protected by a key derived from your password via PBKDF2. This is a respectable, modern design — the per-item key derivation in particular is the kind of detail that separates careful implementations from checkbox ones. The crucial caveat, again, is that this entire apparatus only engages once you've enabled E2EE; until then, sync protection depends on transport security and the trust you place in the storage backend.

Filarr's encryption is structured differently because it's protecting files at rest rather than primarily protecting a sync stream. Each file gets its own random 256-bit File Encryption Key — what the codebase calls the FEK — and the file content is sealed with AES-256-GCM under that key. The per-file FEK is then "wrapped" (encrypted) by a Key Encryption Key, the KEK, which is derived from your password using PBKDF2 with SHA-512 and 600,000 iterations, a figure that tracks the OWASP guidance for PBKDF2 and is deliberately high to make password-guessing expensive. Argon2id is available as an optional, even more guessing-resistant derivation. This wrap-and-unwrap structure has a quietly important property: changing your password only re-wraps the FEK rather than re-encrypting every file, and multiple devices can each derive the same KEK from the password and unwrap the FEK independently, which is what makes multi-device access work without a central server holding your keys. The per-file key isolation also means a compromise scoped to one file's key doesn't generalize to your whole vault.

Now let's run the threat models, because a cipher name tells you almost nothing until you ask "protects against whom." Threat model one: a malicious or compromised sync server. Joplin with E2EE enabled handles this well — the server sees only ciphertext, which is precisely the point of E2EE, and this is true across all its sync targets including Dropbox and Nextcloud. Filarr handles this by design because what gets uploaded to its Cloudflare R2 backend (or your own S3-compatible bucket if you bring your own storage) are opaque encrypted blobs; the sync layer is described in the code as zero-knowledge, meaning the server stores ciphertext it cannot read. On this axis the two are comparable, with the asterisk that Joplin requires you to have enabled E2EE first and Filarr requires nothing.

Threat model two: the stolen, powered-off laptop. This is where the default matters most. Filarr's files are AES-256-GCM-encrypted on disk regardless of any other protection, so a thief with your drive has ciphertext and needs your password to derive the KEK and unwrap anything. Joplin's answer depends on factors outside Joplin: if you enabled full-disk encryption (FileVault, BitLocker, LUKS) the local database is protected by that, and if you didn't, the local Joplin database is not itself shielded by E2EE in the way at-rest file encryption would shield it. So for the stolen-laptop case, Filarr protects you by default and Joplin protects you if-and-only-if you've layered OS encryption underneath. Threat model three: the weak password. Both products ultimately reduce to your password's strength against offline guessing, and both use PBKDF2 to slow that guessing down; Filarr's 600,000 iterations and optional Argon2id are a strong posture, but neither app can save you from a genuinely terrible password, and you should be skeptical of any product that claims it can. Threat model four: legal compulsion or a subpoena to the cloud provider. Here both shine for the same reason — a provider served with a demand can only hand over ciphertext it cannot decrypt, whether that's Joplin's E2EE blobs or Filarr's R2 blobs, because in neither design does the server hold your keys. The honest summary is that Joplin can match Filarr on every one of these threat models, but several of them require you to have made the right configuration choices, whereas Filarr's defaults cover them out of the box. That is the entire difference, stated as plainly as I can state it.

How sync and multi-device actually work

Sync is where the architectural differences become tactile, because it's the part of these apps that has to reason about two machines disagreeing about reality. Joplin's great strength here is choice: it speaks to a genuinely impressive range of backends out of the box, with no third-party plugins required — Joplin Cloud, Dropbox, OneDrive, Nextcloud, WebDAV, the local filesystem, and S3-compatible object storage. This means you are never locked into Joplin's own hosting; if you already run a Nextcloud instance or pay for Dropbox, Joplin slots into infrastructure you control or already trust. The sync model is a synchronize-the-whole-corpus approach, and with E2EE on, everything that crosses the wire and lands on that backend is encrypted before it leaves your device. The flexibility is real and it's one of the best arguments for Joplin: your data, your storage, your choice of provider, and you can change your mind later.

Filarr's sync is narrower by design and philosophically subordinate. The default cloud backend is Cloudflare R2, with the option to bring your own S3-compatible bucket if you'd rather not use Filarr's hosting, and the data stored there is opaque encrypted blobs. But the defining characteristic is that sync is optional in a way it structurally cannot be for a cloud-first app — because Filarr encrypts locally first, the cloud is a follower that propagates already-encrypted state, not the system of record that everything depends on. The multi-device mechanism leans on the wrap/unwrap key design: each device derives the same KEK from your password and unwraps the shared FEK, so devices can independently decrypt the synced blobs without a server ever holding a decryptable key. It's a clean model, though I'll be candid that it doesn't yet match Joplin's breadth of backend options, and Joplin's years of sync-conflict edge-case handling are exactly the kind of maturity a younger product has to earn over time rather than claim.

The scenarios that separate them are the unhappy ones. What happens offline? Both work fully offline, because both keep your data local — this is a genuine shared strength and one reason both attract people fleeing pure-cloud apps. What happens when the sync server is down? For Joplin, you keep working locally and sync catches up when the backend returns; for Filarr, the same, with the added comfort that the local copy was already the encrypted source of truth rather than a cache of a server's state. What happens when you stop paying? This is the question cloud-first apps dread and local-first apps answer easily. With Joplin, if you cancel Joplin Cloud, your notes are still on your devices and you can point sync at a different backend or none. With Filarr, cancelling cloud sync leaves you with a fully functional, fully encrypted local workspace, because the cloud was never the product — it was the optional follower. In both cases, the local-first foundation means "the company changes its pricing" or "the company disappears" is an inconvenience, not a catastrophe, which is more than the Notions of the world can say.

Losing access, and getting back in

The terrifying flip side of real encryption is that it works against you too: if the system genuinely can't read your data without your password, then neither can you, if you lose that password. Both products have to confront this, and how they confront it tells you a lot about who they're built for. Joplin's E2EE is explicit that your password protects the master key, and Joplin Cloud accounts have an account password for the service itself, but the philosophy is the unsentimental one common to serious E2EE: the encryption password is yours to keep, and if you lose the key material that protects your encrypted data, that data is not recoverable by the provider, because a provider who could recover it could also be compelled to surrender it. This is the correct security posture and also the one that bites people who treat an encryption password like a website login they can reset. The mitigation is the boring one that works: a password manager and discipline.

Filarr adds a recovery mechanism that's worth understanding because it directly addresses the lost-password nightmare. On top of the password-derived KEK, Filarr can wrap the same FEK a second time with a key derived from a 24-word BIP-39 recovery phrase — the same standard the cryptocurrency world uses for seed phrases. The practical effect is that there are two independent paths to unwrap your file key: your password, and your recovery phrase. Forget the password, and the 24 words can still get you in; the code explicitly stores a recovery-wrapped copy of the FEK alongside the password-wrapped one. This is a meaningful usability improvement over a pure password-only model, but — and this matters — it relocates the risk rather than eliminating it. Those 24 words are now a master key to your entire vault, so writing them on paper and storing them somewhere safe (and not in the same encrypted vault they unlock) is non-negotiable. A recovery phrase you've lost is no better than a password you've forgotten, and a recovery phrase someone else finds is a full compromise.

The scenario that haunts everyone in this space is account death — what happens to your encrypted notes when you die, or when an account simply goes dormant. Neither product offers a magical answer, because there isn't one that's compatible with real encryption: any "emergency access" feature is, by definition, a backdoor, and a backdoor for your heirs is a backdoor for an attacker or a court. What both products effectively do is push this into your hands, which is the honest place for it to live. With Joplin, you'd document your encryption password in whatever estate or password-handoff system you trust. With Filarr, the 24-word recovery phrase becomes the thing you can hand to a trusted person or store with your will, which is arguably a cleaner artifact to bequeath than a long password, precisely because the BIP-39 format is designed to be written down and transcribed without error. In both cases, the uncomfortable truth is the same: real encryption means you are the custodian, and the apps can only give you better or worse tools for custody, never relieve you of it.

The one big table

Before the table, a word on how to read it: a checkmark is not a verdict, it's an invitation to read the prose around it, because nearly every row here has a "yes, but" that the cell can't hold. With that caveat, here's the side-by-side.

Dimension	Joplin	Filarr
Core model	Markdown notes + to-dos	Encrypted workspace (notes + files + graph)
Encryption default	Opt-in (enable E2EE manually)	On by default, at rest, from first save
Cipher	AES-256-GCM (newer methods; older AES-256-CCM)	AES-256-GCM, per-file key
Key derivation	PBKDF2 (master-key protection)	PBKDF2-SHA-512, 600k iterations; Argon2id optional
Key structure	Random 256-byte master key, per-item subkeys	Per-file FEK wrapped by password-derived KEK
Recovery	Password / account-based	24-word BIP-39 recovery phrase
Local-first	Yes (local DB, works offline)	Yes (encrypted files on disk, works offline)
Sync backends	Joplin Cloud, Dropbox, OneDrive, Nextcloud, WebDAV, S3, filesystem	Cloudflare R2 (default) or bring-your-own S3
Cloud server sees	Ciphertext (with E2EE on)	Opaque encrypted blobs (zero-knowledge)
File types	Markdown notes; attachments tied to notes	51+ formats as first-class encrypted objects
Graph view	No (plugins approximate links)	Yes, native
Plugins	~200, mature ecosystem	Young, limited
Web clipper	Yes, official	No
Mobile	Mature (iOS, Android)	In progress
Platforms (desktop)	Windows, macOS, Linux	Windows, macOS, Linux (Electron + React)
License	AGPL-3.0	Desktop client BSL 1.1 (website AGPL-3.0)
Free local use	Yes	Yes, free forever
Paid cloud	Joplin Cloud from ~€2.40/mo (yearly Basic)	Sync from €4/mo

The table makes the shape of the decision visible. Joplin wins on ecosystem breadth, sync-backend flexibility, mobile maturity, and the sheer accumulated polish of a long-lived project. Filarr wins on encryption-by-default, treating files and the graph as first-class, and the recovery-phrase ergonomics. Where they tie — local-first operation, AES-256-GCM, zero-knowledge cloud storage when configured — they tie because they're both serious about the same underlying goal. A spec table can't tell you which set of strengths matches your life, but it can stop you from believing the strengths are the same.

Where Joplin genuinely wins

I want to spend real words here, because a comparison that can't articulate the competitor's advantages isn't honest, and Joplin's advantages are substantial. The first and most obvious is maturity. Joplin has been carrying real users' real data since 2017, which means its sync conflict resolution, its import and export paths, its handling of the thousand weird states that note databases get into over years of use — all of that has been stress-tested by time in a way no two-year-old product can claim. When you're trusting software with the contents of your head, "it has survived a long time without losing people's notes" is not a soft benefit; it's close to the most important thing, and Filarr simply hasn't lived long enough to make that promise with the same authority.

The second is the ecosystem. Joplin has on the order of 200 plugins as of 2026, covering templates, tables of contents, enhanced Markdown editing, backup automation, and far more, and it ships an official web clipper that turns the perpetual annoyance of "save this article" into a one-click action that lands clean Markdown in your notebook. This is the compounding advantage of an open platform with years of community momentum: the gaps in the core product get filled by people who needed them filled. Filarr's extension story is, frankly, nascent by comparison, and if your workflow depends on a specific plugin or on web clipping, Joplin isn't just ahead, it's in a different weight class, and pretending otherwise would waste your time.

The third is sync flexibility and the freedom that comes with it. Joplin's willingness to sync through Dropbox, OneDrive, Nextcloud, WebDAV, S3, or plain filesystem means you are never a hostage to its hosting. If you already run a Nextcloud server, Joplin meets you there; if you distrust one provider, you switch to another in minutes; if you want to pay no one, you sync through storage you already own. That optionality is a genuine expression of the open-source ethos, and it's something Filarr, with its R2-default-plus-bring-your-own-S3 model, offers in a narrower form. The fourth, related win is the AGPL license and the fully open codebase, which I'll treat in its own section but which belongs on this list because for a meaningful slice of privacy-conscious users, "can I read and fork every line" is a hard requirement, and Joplin clears it completely. And the fifth, quieter win is mobile: Joplin's iOS and Android apps are mature and well-worn, while Filarr's mobile experience is still being built, so if your notes live primarily on a phone, today, Joplin is the realistic choice.

Where Filarr genuinely wins

Filarr's advantages are narrower in number but, for the people they fit, decisive. The first is the one this whole article keeps circling: encryption is the default, not a toggle. There is no window of exposure between installation and configuration, no "oh, I never turned that on" six months later, no dependence on the user having found a settings screen. Every file is AES-256-GCM-encrypted on disk from the first save, with a per-file key, full stop. For a user who wants safety without having to become their own security administrator, that default is not a minor convenience — it's the entire value proposition, and it's the thing Joplin structurally cannot match without changing what Joplin is, because Joplin's local database isn't built to be E2EE-at-rest by default.

The second win is scope: notes, files, and the relationships between them, in one encrypted space. Joplin is exceptional at notes and treats files as attachments to those notes; Filarr treats a PDF, an image, a spreadsheet, and a Markdown note as equal citizens — 51-plus formats handled as first-class encrypted objects — and gives you a native graph view to see how they connect. If your real work is heterogeneous, if the document you're protecting is as likely to be a contract or a design file as a note, Filarr is protecting and organizing the whole thing while Joplin is protecting the notes and bolting the rest on. The multi-profile workspaces deepen this: you can keep genuinely separate encrypted contexts for, say, work and personal life, rather than relying on notebooks within a single vault.

The third win is the recovery-phrase model, which I think is underrated. A 24-word BIP-39 phrase is a far better artifact for the lost-password problem than a password-only scheme: it's standardized, designed to be transcribed by hand without error, and it gives you a second independent unwrap path for your file key without weakening the cryptography. It turns "I forgot my password and my data is gone forever" — the most common and most heartbreaking failure mode of serious encryption — into a recoverable situation, provided you stored the phrase responsibly. The fourth win is the cleanliness of the local-first-with-optional-cloud posture: because the cloud only follows, cancelling sync or distrusting the provider costs you nothing functionally, and the zero-knowledge R2 blobs mean even Filarr's own hosting can't read your data. None of these wins make Filarr the right choice for everyone — they make it the right choice for someone who wants encrypted-by-default coverage of an entire workspace, and who values that more than plugin breadth and mobile maturity. That's a real audience, but it's a specific one, and I'd rather tell you that than oversell.

Migrating from one to the other

Let's talk about the friction of actually moving, because the abstract comparison is useless if switching is a nightmare. Moving from Joplin to Filarr has one big thing going for it: Joplin is Markdown-first and exports cleanly. Joplin can export to Markdown and to its own JEX format, and because your notes are fundamentally plain text, getting them out is not the hostage situation that leaving a proprietary app can be. You'd export your notebooks as Markdown, which gives you a folder tree of .md files plus the attached resources, and then bring those into Filarr, where they become encrypted-at-rest files like everything else. The friction points are the usual ones for any note migration: Joplin's internal note links and tags don't always survive a plain Markdown export with full fidelity, and you'll likely spend time re-establishing the structure and re-linking notes into Filarr's graph. What you gain in the move is encryption-by-default and files-as-first-class; what you lose, at least at first, is the plugin conveniences and the web clipper you may have come to rely on.

Moving from Filarr to Joplin is the direction that tests how serious a product is about not locking you in, and the honest answer is that Filarr's notes, being standard content, can be exported and brought into Joplin's Markdown world, but the things that are distinctly Filarr — the graph relationships, the non-note files as first-class objects, the multi-profile workspaces — don't have clean equivalents in Joplin, so they degrade into Joplin's note-plus-attachment model. Your text survives the trip; your workspace's richer structure flattens. This is not unique to Filarr; it's the general truth that you can always move plain content between serious tools, but the value a tool adds on top of plain content is precisely the value you leave behind when you leave. The reassuring part, in both directions, is that neither app holds your actual words hostage — the Markdown ethos that Joplin pioneered and Filarr respects means your core content is always portable, which is exactly the property you should demand before trusting any app with your thinking.

My practical advice, regardless of direction, is to migrate in waves rather than all at once. Move your active, current material first and live with it for a few weeks before committing your archive, because the friction you'll actually feel is rarely in the export step and almost always in the re-learning of muscle memory — where things are, how linking works, what the keyboard shortcuts are. Keep the old app installed and its data intact until you're certain, because the worst migration outcome isn't friction, it's discovering a gap after you've deleted your source of truth. Both of these products make that safe to do, because both keep your data local, which means "keep the old one around as a backup" costs you nothing but disk space.

Pricing, decoded with real numbers

The headline for both products is the same and it's the right headline: local use is free. Joplin's apps are free and open source, and you only pay if you choose its hosted sync; Filarr is free forever for local use, and you only pay if you choose its cloud sync. So before any subscription enters the picture, both let you have a fully functional, encrypted, local workspace for exactly zero euros, which is a posture the Notions and Evernotes of the world abandoned long ago. Whatever you decide, neither app is going to charge you for the privilege of writing notes on your own computer, and that alone puts them in a healthier category than most of the market.

Where money appears is cloud sync, and the numbers tell a nuanced story. Joplin Cloud has tiers: a Basic plan around €2.40 per month billed yearly (or roughly €2.99 month-to-month) with 2 GB of storage and a 10 MB per-note/attachment cap, a Pro plan around €4.79 per month with 30 GB and a 200 MB item cap that adds the web clipper, collaboration, and notebook sharing, and a Teams plan around €6.69 per month with 50 GB. Filarr's cloud sync starts at €4 per month. So on raw entry price, Joplin's Basic tier undercuts Filarr, and if your needs are small-text-notes-only, Joplin Cloud Basic is genuinely cheap. But the comparison isn't apples-to-apples, because Joplin's Basic tier has a 2 GB ceiling and a 10 MB-per-item cap that a files-heavy workflow blows through immediately, whereas Filarr is built around syncing files, not just notes, so its pricing assumes a different kind of payload from the start.

Let me run three scenarios. Scenario one, the light text note-taker: a few hundred Markdown notes, no big files, syncing across two devices. Here Joplin Cloud Basic at ~€2.40/month is the value winner, full stop — 2 GB is plenty for pure text, and you'd pay Filarr €4 for capabilities (file sync) you're not using. Scenario two, the files-and-notes knowledge worker: notes plus a growing pile of PDFs, images, and documents, the kind of payload that's measured in gigabytes and includes individual files well over 10 MB. Here Joplin Basic is immediately too small and you're pushed toward Pro at ~€4.79 for the 30 GB and 200 MB item cap, which puts it within spitting distance of Filarr's €4, and now the decision turns on whether you value Joplin's ecosystem or Filarr's encrypted-files-first design more than the small price gap. Scenario three, the privacy-maximalist who self-provisions storage: someone who wants to own their storage outright. With Joplin, you sync through your own Nextcloud, WebDAV, or S3 and pay Joplin nothing; with Filarr, you bring your own S3-compatible bucket and pay for the storage rather than a Filarr subscription. In this scenario both can approach zero recurring cost to the app vendor, with Joplin's broader backend support giving it a slight edge in flexibility. The pattern across all three: Joplin is cheaper for light text use, the two converge for serious file-plus-note use, and both reward the self-hoster.

Open source and license, in plain terms

This is the section where the lawyers usually win and the readers usually leave, so I'll keep it concrete. Joplin is licensed under AGPL-3.0, which is one of the strongest copyleft licenses in existence, and for the privacy-conscious that's a feature, not a footnote. AGPL means not only that you can read, modify, and redistribute the code, but that anyone who runs a modified version as a network service must also release their modifications — it's specifically designed to prevent the "take open-source code, run it as a closed SaaS, give nothing back" maneuver. For a user, the practical implications are real: you can fully audit Joplin's encryption (and people have), you can self-host the sync server, you can fork the whole project if the maintainers ever go a direction you dislike, and you have zero dependence on the company's goodwill for continued access to the software itself. That's about as strong an ownership guarantee as open source offers.

Filarr's licensing requires a distinction that's easy to garble, so let me state it carefully: the desktop client is open source under the Business Source License 1.1 (BSL 1.1), while the website is separately licensed under AGPL-3.0. BSL 1.1 is a "source-available" license that is not the same as a traditional open-source license like AGPL — the source is readable and you can audit it, which is the part that matters most for trusting an encryption product, but BSL typically restricts certain commercial/competing uses for a period before converting to a fully open license. The honest framing is that Filarr's client is more open than a closed-source app and you can inspect exactly how the encryption works, but it is less permissively licensed than Joplin's AGPL, and if your requirement is "must be OSI-approved open source with no usage restrictions," Joplin meets that bar and Filarr's client, today, does not. I'd rather you know that going in than discover it later.

Why does this matter beyond ideology? Because for an encryption product specifically, the ability to read the code is a security property, not just a philosophical one — "trust us, it's encrypted" is worth far less than "here's the code, verify it's encrypted." Both products clear the bar that matters most: their encryption is auditable, not a black box. Where they differ is in the downstream freedoms — Joplin's AGPL gives you the full suite of fork-and-redistribute rights with no commercial restrictions, while Filarr's BSL client gives you inspectability with some usage limits. If maximal license freedom is a core value for you, weight that toward Joplin honestly. If your concern is "can I verify the crypto and not be locked in on my data," both deliver, because the data portability via Markdown export is independent of the code license entirely.

Who should pick which

Let me get specific with personas, because "it depends" is a cop-out and you came here for a recommendation. If you are a long-time Markdown power user with a large existing note corpus and a plugin habit — you live in plain text, you've got a web-clipping workflow, maybe you self-host Nextcloud — choose Joplin, and don't agonize about it. Its maturity, its ecosystem, its sync flexibility, and its AGPL openness are exactly tuned to you, and Filarr would ask you to give up conveniences you depend on in exchange for a default (encryption-on) that you, as a careful user, would have configured manually anyway. You are the user Joplin was built for, and you should feel zero FOMO.

If you are a privacy-conscious knowledge worker whose data is more than text — you're protecting contracts, screenshots, financial documents, and the notes that tie them together, and you want all of it encrypted without becoming a security administrator — choose Filarr. The encrypted-by-default posture means you can't accidentally leave the door open, the 51-plus-format support means your files are first-class rather than attachments, and the graph view lets you see the structure of your work. You'd find Joplin asks you to keep your files in a separate world from your notes, and to remember to turn encryption on, both of which are precisely the frictions Filarr removes.

If you are the security-defaults person — the one who knows that the most dangerous setting is the one you forgot to change, who wants the safe state to be the default state for yourself and maybe for less technical people you support — choose Filarr, because that single design decision is its reason for existing. And if you are the open-source absolutist or the mobile-first note-taker — someone for whom an OSI-approved, no-restrictions license is non-negotiable, or whose notes live primarily on a phone today — choose Joplin, because its AGPL license and mature mobile apps meet requirements that Filarr's BSL client and in-progress mobile story currently don't. Four personas, four clear answers, and the through-line is that this is not a fight over which app is "better" but a question of which set of trade-offs is shaped like your life.

Conclusion: pick the default you can live with

If I've done this right, you no longer need me to tell you which to choose, because you can feel the shape of the decision. Joplin and Filarr both believe your notes are yours and that no server should be able to read them, and both are honest, local-first, auditable expressions of that belief — which already puts them in rare company. The difference is where they put the burden. Joplin hands you a powerful, mature, open toolkit and trusts you to assemble safety from it: enable E2EE, lean on full-disk encryption, choose your sync backend, install your plugins. Filarr makes the safe configuration the only configuration and builds outward from there, at the cost of being younger, narrower in ecosystem, and source-available rather than fully open. Neither of those is the wrong answer. They're answers to slightly different questions.

The question I'd actually ask yourself is this: do you want a tool that gives you maximum control and trusts you to use it well, or a tool that makes the right choice the automatic one and gets out of your way? If the former, and especially if you're a Markdown native who wants plugins, mobile, and an AGPL license, Joplin is genuinely excellent and I'd point my own friends to it without hesitation. If the latter, and especially if your work is files-plus-notes and you want encryption you can't forget to turn on, that's the gap Filarr was built to fill, and it's the reason I built it. Whichever you choose, you'll be choosing a product that respects your ownership of your own data — which, in 2026, is still distressingly rare, and worth celebrating regardless of which logo ends up in your dock.

FAQ

Is Joplin encrypted by default? No. Joplin supports strong end-to-end encryption, but you have to enable it manually on one device first via the Encryption Configuration screen, after which it applies to your synced notes, notebooks, tags, and resources. Until you turn it on, your sync protection depends on transport security and the trust you place in your chosen storage backend, and your local database isn't shielded the way at-rest file encryption would shield it. Filarr, by contrast, encrypts every file at rest with AES-256-GCM from the first save, with no switch to flip.

Do Joplin and Filarr use the same encryption? They use the same cipher but different architectures. Both use AES-256-GCM (Joplin's newer methods moved up from an older AES-256-CCM scheme). Joplin centers on a random 256-byte master key with per-item derived subkeys, protected by a PBKDF2-derived key from your password. Filarr gives each file its own random 256-bit key (the FEK), wrapped by a key derived from your password via PBKDF2-SHA-512 at 600,000 iterations, with optional Argon2id. The cipher is the same; what's protected, and by default or not, differs.

Can the cloud provider read my notes in either app? No, when each is configured as intended. With Joplin's E2EE enabled, the sync backend — whether Joplin Cloud, Dropbox, or Nextcloud — only ever sees ciphertext. Filarr uploads opaque encrypted blobs to Cloudflare R2 (or your own S3 bucket) in a zero-knowledge design, so the server stores data it cannot decrypt. The difference is that Joplin requires you to have enabled E2EE first, while Filarr's cloud storage is encrypted by default because the local data was already encrypted before sync.

What happens if I forget my password? This is the hard edge of real encryption. Joplin follows the standard serious-E2EE stance: the provider cannot recover your encrypted data, so a lost encryption password means lost data unless you've stored it safely. Filarr adds a 24-word BIP-39 recovery phrase as a second, independent path to unwrap your file key, so a forgotten password is recoverable if you saved the phrase — but lose both the password and the phrase and the data is gone, by design.

Which is better for storing files, not just notes? Filarr, clearly. It treats 51-plus file formats as first-class encrypted objects alongside notes, with a graph view linking them, and it's built around syncing files rather than just text. Joplin is Markdown-note-centric and handles other files as attachments tied to notes, and its cheaper cloud tier caps individual items at 10 MB, which a files-heavy workflow exceeds quickly. If your data is heterogeneous, Filarr is solving a problem Joplin doesn't really target.

Is Joplin or Filarr cheaper? For light, text-only note-taking, Joplin Cloud's Basic tier (around €2.40/month billed yearly) undercuts Filarr's €4/month sync. But Joplin Basic caps you at 2 GB and 10 MB per item; a files-and-notes workflow pushes you to Joplin Pro (around €4.79/month), which lands close to Filarr's price. Both are free for local-only use, and both let privacy-maximalists self-host storage (Joplin via Nextcloud/WebDAV/S3, Filarr via bring-your-own S3) to minimize recurring vendor cost.

Are both of these open source? Joplin is fully open source under AGPL-3.0, including its sync server, with no usage restrictions. Filarr's desktop client is source-available under the Business Source License 1.1 (its website is separately AGPL-3.0). Both let you inspect the encryption code — which is the property that matters most for trusting a security product — but Joplin's AGPL grants broader fork-and-redistribute freedoms, while Filarr's BSL client is inspectable with some commercial-use restrictions.

Should I switch from Joplin to Filarr? Only if your needs have outgrown what Joplin is for. If you're happy with Markdown notes, plugins, mobile, and you've enabled E2EE, Joplin is excellent and switching gains you little. Switch if you want encryption on by default with no configuration, if you need files and notes (and their connections) in one encrypted space, or if you want the recovery-phrase model. Either way, Joplin's clean Markdown export means your core content is portable, so you can try Filarr without burning your bridges.