Notes that save themselves
Add, search, open and reorder notes from the sidebar. Type and Bastion encrypts and saves a moment after you stop. There's no Save button to forget.
Encrypted by default · Built with Rust
→
Your secrets,
Your secrets,
locked down.
Bastion is a notepad for the things you can't afford to lose or leak — passwords, recovery codes, account details, private notes. Everything is encrypted before it ever touches the disk, and only your master password opens it.
✓ No cloud, no account
✓ Nothing stored unencrypted
✓ Single native binary
Encrypted
Sealed before it's saved
Every note is encrypted in memory and only ciphertext reaches the disk. A stolen laptop, a copied file or a leaked backup gives away nothing but noise.
Private
Yours, and only yours
No account, no sync service, no telemetry. Bastion never talks to the network. Your vault is a single file on your own machine.
Recoverable
Forget the password, not the vault
An offsite recovery key and encrypted backups mean a forgotten password or a dead drive doesn't take your notes with it.
Features
A notepad that keeps its mouth shut.
Everything a plain notepad does, with the paranoia built in, so you don't have to think about it.
Offsite recovery key
Shown once when you create your vault. Print it or put it on a USB stick kept somewhere else. It's your way back in if you forget the password.
Locks itself
Walk away and Bastion locks after the idle time you choose, wiping keys and text from memory. Or hit the orange lock, or Ctrl+L.
A clipboard that cleans up
Copied secrets stay out of Windows clipboard history and cloud sync, and are wiped after 30 seconds, on lock and on exit.
Invisible to screen capture
The window shows up blank in screenshots, screen recordings and Teams or Zoom screen shares, so a stray share never shows your notes.
Encrypted backups
Export a copy to a drive, another PC or the cloud. It stays encrypted wherever it goes and restores in one click from the lock screen.
🦀 Built with Rust
Encryption you
can actually check.
No home-made cryptography and no vague promises. Bastion uses the same well-studied algorithms as modern password managers, and says exactly what they are.
-
1
XChaCha20-Poly1305
Notes are sealed under a random 256-bit key. Change a single bit of the file and Bastion refuses to open it rather than hand back altered text.
-
2
Argon2id, 512 MiB per guess
Your master password is stretched with a memory-hard function, so every guess costs an attacker half a gigabyte of RAM. That's what stops GPU cracking.
-
3
Memory-safe Rust
Buffer overflows and use-after-free bugs are ruled out at compile time, and keys and text are wiped from memory when the vault locks.
vault.bastion
{
"format": "bastion-vault",
"kdf": { "algorithm": "argon2id", "m_kib": 524288, … },
"password_slot": { … },
"recovery_slot": { … },
"payload": {
"nonce": "I7jacpDEyF8zXaIFEoq7du9AmfHmq3O0",
"ciphertext": "hP/BsD94OluW7VTFbmzJh+j2x5xQ0cTqAf9LZr2MwBnE7uXk3JdPgVy1oHs8RaCtN6WlIeK5vYbFzUqGm4Dj0SxpLwTnO7Rc…"
}
}
✓ 0 readable words · ✓ tamper-evident
What a thief would find. Illustrative file.
How it works
Locked down in under a minute
01
Choose a master password
A strength meter guides you. Four or more random words make a password that's easy to type and hard to guess. It's never stored anywhere.
02
Store your recovery key
Save the recovery kit to a USB stick or print it, and keep it somewhere other than your computer. It's shown once, then it's yours to keep.
03
Write freely
Hit + or Ctrl+N and start typing. Every change is encrypted and saved automatically.
Plain about the limits: Bastion protects your notes on disk and on screen, but no app can protect them from malware already running on your PC while the vault is open. Keep your system clean and your recovery key safe.
Keep what matters behind the wall.
Encrypted, private and recoverable. A single file for Windows 10 and 11, with nothing to install.