Settings — Storage

Choose how your notes are persisted and protected: plain Markdown files on disk, or an encrypted database. Configure auto-lock to keep an unattended laptop safe.

Storage backends

Binderus supports two storage models:

Backend	Format	Encryption	Best for
Filesystem (default)	Plain `.md` files in your vault folder	None at rest (rely on disk encryption)	Maximum portability, easy backup, version control with git
Encrypted DB (libsql)	SQLite database, encrypted at rest	AES-256 with passphrase	Sensitive notes, journaling, second-factor protection on top of disk encryption

You can switch back and forth. Migration is a one-click operation — Binderus reads from the active backend and writes to the new one without losing notes.

Encrypted database

When you select the encrypted backend for the first time, Binderus prompts for a passphrase. Pick a strong one — there is no recovery. If you lose the passphrase you lose access to the notes, and Binderus cannot help.

Passphrase is never stored on disk in plaintext
Derived key uses Argon2id (configurable cost)
Database file lives at <vault>/.binderus/notes.db
Files outside the database (images, attachments) remain plain on disk unless you opt into attachment encryption

Auto-lock

For encrypted vaults, Binderus can re-lock the database after a period of inactivity, requiring the passphrase to reopen.

Auto-lock timeout — minutes of idle time before locking. Default 15. Set to 0 to disable.
Auto-lock on minimize — lock immediately whenever the Binderus window is minimized or sent to background. Recommended on shared workstations.

Migration to encrypted DB

Migrating a filesystem vault to an encrypted DB:

Open Settings → Storage
Pick Encrypted DB (libsql)
Enter a strong passphrase (twice)
Click Save
Confirm — Binderus reads every note, writes them into the encrypted DB, and verifies the count
A restart is required after migration completes

Original Markdown files remain in the vault folder until you remove them manually — useful for confirming the migration before committing.

Exporting from an encrypted vault

An Export DB action under Advanced writes every note back to plain .md files in a folder you choose. Useful for backup, audit, or migrating away.

Backup discipline: the encrypted DB is one file. Lose or corrupt it and you've lost the vault. Treat it like any other irreplaceable file — at minimum, keep a synced copy on a second device or service. The plain .md backend is more forgiving here because corruption is local to one note.