Jotyz

A modern, encrypted note-taking application with hierarchical folder organization, drag-and-drop support, and client-side encryption.

Features

• Hierarchical Folder Organization — Organize notes in nested folders with unlimited depth
• Drag & Drop — Easily move notes between folders or reorganize folder structure
• Rich Text Editor — TipTap-powered markdown editor with full formatting support
• Client-Side Encryption — Notes are encrypted before leaving your browser using AES-256
• Auto-Save — Changes are automatically saved
• Session Management — Cookie-based authentication with session tracking

Tech Stack

Frontend

• React 18 + TypeScript
• Vite
• TipTap
• Zustand
• ReactQuery
• dnd-kit (drag and drop)
• Tailwind CSS

Backend

• FastAPI (Python)
• SQLModel / SQLite
• bcrypt (password hashing)
• Session-based authentication

Getting Started

Prerequisites

• Node.js 20+
• Python 3.12+
• Docker & Docker Compose (optional)

Development Setup

Helper script

Navigate to the root of the project and run:

// Install dependencies
npm install

// Start the dev environment
npm run dev

This will run both the backend and the front end off one script. If you wish to run each of them seperatly then follow the instructions below.

Backend

cd backend

// Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

// Install dependencies
pip install -r requirements.txt

// Run the fastAPI server
uvicorn app.main:app --reload --port 8000

Frontend

cd frontend

// Install dependencies
npm install

// Start dev environment 
npm run dev

The app will be available at http://localhost:5173

Docker Deployment

// Build and run with Docker Compose
docker compose up -d

// View logs
docker compose logs -f

API Endpoints

The backend is built with FastAPI so if you spin up a dev instance of the backend you can navigate to localhost:8000/docs for the full schema on the endpoints.

Encryption Architecture

Jotyz uses a two-layer encryption system:

1. Master Key — A random AES-256 key generated during registration
2. Key Encryption Key (KEK) — Derived from user's password using PBKDF2

The master key is wrapped (encrypted) with the KEK before being stored on the server. This means:

• Your password never leaves your device
• The server only stores encrypted keys
• Changing your password only requires re-wrapping the master key
• Allows the ability to share encrypted notes with a separate password - planned feature

Environment Variables

• VITE_API_URL default = '/api'. If you're connecting with another database this will need updating.
• DATABASE_URL default = 'sqlite:////app/data/notes.db' location of the sqlite db.
• CORS_ORIGINS This has to be set as your frontend URL.