Joplin

joplinapp.orgWindows, MacOS, Linux, Android, iOS

Awesome Privacy➔ Productivity➔ Digital Notes➔ Joplin

Cross-platform desktop and mobile note-taking and todo app. Easy organisation into notebooks and sections, revision history and a simple UI. Allows for easy import and export of notes to or from other services. Supports synchronisation with cloud services, implemented with E2EE.

Homepage:joplinapp.org
GitHub:github.com/laurent22/joplin
Privacy:joplinapp.org/privacy
iOS App:apps.apple.com/gb/app/joplin/id1315599797
Android App:play.google.com/.../net.cozic.joplin
Subreddit:r/JoplinApp
Web info:web-check.xyz/check/joplinapp.org

Security Audited Open Source

Joplin Privacy Policy

Privacy Policy Summary

You can delete your content from this service

Score

Documents

About the Data

This data is kindly provided by tosdr.org. Read full report at: #9477

Joplin Source Code

Author

laurent22

Description

Joplin - the privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.

#android#dropbox#electron#enex-files#evernote#javascript#joplin#nextcloud#nodejs#note-taking#notesnook#obsidian#onedrive#react-native#standardnotes#synchronisation#web-clipper#webdav

Homepage

https://joplinapp.org

Repository

LicenseOther
Created16 Jan 17
Primary languageTypeScript
Size664,139 KB
Stars56,630
Forks6,324
Watchers56,630

Language Usage

Project Health

Last commit6 days ago
Open issues643
Latest releasev3.7.21

Top Contributors

Recent Commits

Laurent Cozic(07 Oct 26)
Desktop: Fix external editor saves being lost immediately after opening a note (#16771)
renovate[bot](06 Oct 26)
chore(deps): update dependency yauzl to v3.4.0 (#16767) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate[bot](06 Oct 26)
chore(deps): update dependency @crowdin/cli to v4.14.3 (#16765) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
mrjo118(06 Oct 26)
Desktop, Mobile, Cli: Fixes #15601: Fix S3 sync failing in the web app with getReader TypeError on some browsers (#16746)
mrjo118(06 Oct 26)
Desktop, Mobile: Fixes #16759: Fix revision service does not start if the sync on startup fails (#16761)
Henry Heino(06 Oct 26)
Desktop, Mobile: Resolves #16710: Improve E2EE UI when a key is stored in an unknown format (#16711) Co-authored-by: Laurent Cozic <[email protected]>
Henry Heino(06 Oct 26)
Mobile: Fixes #16589: Upgrade React Native to v0.86, Expo to v57 (#16636) Co-authored-by: Laurent Cozic <[email protected]>
Keshav(06 Oct 26)
Mobile, Desktop, Cli: Resolves #16130: Encrypt plaintext bodies on ungated saves of locked notes (#16131) Co-authored-by: Laurent Cozic <[email protected]> Co-authored-by: mrjo118 <[email protected]>
renovate[bot](06 Oct 26)
fix(deps): update dependency js-yaml to v4.2.0 (#16755) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sriram Varun Kumar(05 Oct 26)
Doc: Resolves #16603: Add documentation for conflict auto-merge and desktop resolution UI (#16604) Co-authored-by: Laurent Cozic <[email protected]>
renovate[bot](05 Oct 26)
fix(deps): update dependency prosemirror-dropcursor to v1.8.3 (#16749) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate[bot](05 Oct 26)
chore(deps): update dependency concurrent-ruby to '< 1.3.8' (#16748) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate[bot](05 Oct 26)
chore(deps): update dependency @types/nodemailer to v7.0.12 (#16747) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Laurent Cozic(04 Oct 26)
Chore: Fix flaky test checker
renovate[bot](04 Oct 26)
Update actions/upload-artifact action to v7 (#16735) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Laurent Cozic <[email protected]>
renovate[bot](04 Oct 26)
Update dependency @react-native-community/datetimepicker to v9 (#16739) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Laurent Cozic <[email protected]>
renovate[bot](04 Oct 26)
chore(deps): update dependency @types/nodemailer to v7 (#16742) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
James Carroll(04 Oct 26)
Chore: Resolves #16119: Remove --no-sandbox checks in installation script (#16738)
Laurent Cozic(04 Oct 26)
CI: Repeat test files changed by a pull request to detect flaky tests (#16741)
qx100(03 Oct 26)
All: Translation: Update zh_CN.po (#16737)
mrjo118(03 Oct 26)
Desktop: Show export warnings on export completion to match mobile behaviour (#16682)
Laurent Cozic(03 Oct 26)
Chore: Fixed flaky test
renovate[bot](03 Oct 26)
Update nvidia/cuda Docker tag to v13.3.0 (#16730) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Laurent Cozic <[email protected]>
renovate[bot](03 Oct 26)
Update actions/create-github-app-token action to v3 (#16732) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Laurent Cozic(03 Oct 26)
Chore: Trying to fix flaky test on CI
renovate[bot](03 Oct 26)
Update dependency ts-loader to v9.6.2 (#16731) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Laurent Cozic(02 Oct 26)
Chore: Trying to fix flaky iOS UI test by waiting for elements before tapping
renovate[bot](02 Oct 26)
Update dependency ts-loader to v9.6.0 (#16729) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Aissa Benfodda(02 Oct 26)
Server: Resolves #16669: Published notebook notes cannot be scrolled down on Android browsers (#16702)
mrjo118(02 Oct 26)
Desktop: Fixes #15865: Fix toolbar state becoming disabled on a secondary window when the note has been moved (#16620)

Joplin Security

4.6/10

Repo Security Summary

Updated 24 Aug 26

Code-Review4/10
Maintained10/10
PackagingN/A
CII-Best-Practices0/10
Dangerous-Workflow10/10
Security-Policy10/10
Token-Permissions0/10
License9/10
Branch-ProtectionN/A
Signed-Releases0/10
Binary-Artifacts7/10
SAST0/10
Pinned-Dependencies0/10
Fuzzing0/10

Security Advisories (32)

mediumPatchedCVSS 6.1
GHSA-v9jp-q5hw-w3p3Unvalidated `x-success` / `x-error` callback target reaches `shell.openExternal()`
09 Sept 26
highPatched
CVE-2026-105786Unauthenticated account takeover via an attacker-chosen application-authorisation identifier
09 Sept 26
mediumPatchedCVSS 4.8
CVE-2026-105785Password reset accepts any valid per-user token including CSRF tokens and email-confirmation tokens because the token store has no purpose/type field, enabling full account takeover from a leaked CSRF token or a scanned confirmation-email link
09 Sept 26
highPatchedCVSS 8
CVE-2026-105783Any website open in the browser can trigger and win Joplin's Web Clipper pairing dialog, stealing the permanent full-access API token, because the local server has no Origin/Referer restriction and the confirmation dialog shows no identifying information
09 Sept 26
mediumPatchedCVSS 4.6
CVE-2026-105784Whiteboard note content is rendered into the main application document, bypassing the note-viewer origin isolation and allowing CSS injection with a remote-controlled exfiltration channel
09 Sept 26
mediumPatchedCVSS 4.3
CVE-2026-59815Pending share recipients can write items into shared folders before accepting invitations
09 Sept 26
mediumPatched
CVE-2026-59816Path traversal in transcribe proxy endpoint via URL-encoded slash (CWE-22)
09 Sept 26
highPatchedCVSS 7.6
CVE-2026-59814Stored XSS via inline-served note attachment on published shares
09 Sept 26
highPatchedCVSS 8.8
CVE-2026-55456Path traversal vulnerability in sync logic allows a malicious sync target to create and overwrite arbitrary files
09 Sept 26
mediumPatchedCVSS 6.5
CVE-2026-55179Logic error in Joplin Server allows a signed-in user to read any note from its internal server ID
09 Sept 26
highPatchedCVSS 7.4
CVE-2026-55210SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
09 Sept 26
highPatchedCVSS 7.7
CVE-2026-55105Fountain embeds allow arbitrary script execution in published notes and the note viewer
09 Sept 26
highPatchedCVSS 7
CVE-2026-49453Path traversal in resource sync — silent arbitrary file write outside the resource directory
09 Sept 26
lowPatchedCVSS 2.5
CVE-2026-49449KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows
09 Sept 26
highPatchedCVSS 7.1
CVE-2026-49450Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
09 Sept 26
mediumPatchedCVSS 4.4
CVE-2026-46650Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
09 Sept 26
highPatched
CVE-2026-46649SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
09 Sept 26
mediumPatchedCVSS 5.7
CVE-2026-34600Logic error in Joplin Server allows share recipients to read notes they no longer have access to
15 May 26
highPatchedCVSS 8.2
CVE-2026-22810Path traversal in OneNote importer allows overwriting arbitrary files
15 May 26
mediumPatchedCVSS 5.5
CVE-2025-57798Denial of Service (DoS) via Uncontrolled Resource Allocation in Joplin Title Input
15 May 26
highPatchedCVSS 7.5
CVE-2025-27409Path traversal in Joplin Server
29 Apr 25
highPatchedCVSS 8.8
CVE-2025-27134Privilege escalation in Joplin server via user patch endpoint
29 Apr 25
highUnpatchedCVSS 7.8
CVE-2025-24028XSS in Rich Text Editor allows arbitrary code execution
07 Feb 25
lowPatchedCVSS 3.3
CVE-2024-55630DOM Clobbering leads to temporary DOS in the note viewer
07 Feb 25
highPatchedCVSS 7.2
CVE-2024-53268Lack of validation on openExternal allows XSS
25 Nov 24
highPatchedCVSS 7.8
CVE-2025-25187XSS in Goto Anything allows arbitrary code execution
07 Feb 25
highPatchedCVSS 7.7
CVE-2024-49362XSS on <a> Link in markdown preview
14 Nov 24
highPatchedCVSS 8.6
CVE-2024-40643Parsing error leading to XSS
06 Sept 24
highPatchedCVSS 8.1
CVE-2023-45673Arbitrary code execution on click of PDF links
21 Jun 24
highPatchedCVSS 7.3
CVE-2023-39517XSS when clicking on an untrusted `<map>` link
21 Jun 24
highPatchedCVSS 7.3
CVE-2023-38506XSS when pasting HTML into the rich text editor
21 Jun 24
highPatchedCVSS 7.3
CVE-2023-37898Safe mode XSS vulnerability
21 Jun 24

Joplin Website

Website

Joplin

Joplin, the open source note-taking application

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

IP Address185.199.109.153
Hostnamecdn-185-199-109-153.github.com
LocationFrancisco,Indiana,United States of America,NA
ISPGitHub Inc.
ASNAS54113

Associated Countries

Safety Score

Website marked as safe

100%

Trackers

Loads 2 third-party trackers

google-analytics.comGoogle Analytics
googletagmanager.comGoogle Ads

Blacklist Check

joplinapp.org was found on 0 blacklists

AntiSocial Blacklist
Artists Against 419
Badbitcoin
Bambenek Consulting
CERT Polska
CoinBlockerLists
CRDF
CryptoScamDB
EtherAddressLookup
EtherScamDB
Fake Website Buster
MetaMask EthPhishing
NABP Not Recommended Sites
OpenPhish
PetScams
PhishFeed
PhishFort
Phishing.Database
PhishStats
PhishTank
Phishunt
RPiList Not Serious
Scam.Directory
SecureReload Phishing List
Spam404
StopGunScams
Suspicious Hosting IP
ThreatFox
ThreatLog
TweetFeed
URLhaus
ViriBack C2 Tracker

Website Preview

View full report atweb-check.xyz

Joplin Android App

APK Info

AppJoplin
Creation Date05 Apr 23
Last Updated15 Jul 24
Current Version2.10.8
Privacy ReportView on Exodus →

De-Googled Compatibility

Native4.00/ 411 ratings

microG4.00/ 46 ratings

GrapheneOSNative4.0 / 4(7)
iodeOSmicroG4.0 / 4(2)
LineageOSNative4.0 / 4(2)
CalyxOSmicroG4.0 / 4(2)

Tested on Android 14–17 · Updated 14 Oct 26 · View on Plexus →

Trackers

No trackers found

Permissions

Access Fine Location
Access Network State
Access Wifi State
Internet
Receive Boot Completed
Use Biometric
Use Fingerprint
Vibrate
Wake Lock
Write External Storage
Access Fingerprint Manager
Write Use App Feature Survey

Joplin iOS App

App Info

Joplin

Privacy-first app Capture your thoughts freely and without distractions, tracking, or ads. With Joplin’s end-to-end encryption and open-source code, you can concentrate on your ideas and tasks without worrying about your privacy. Capture multimedia notes Capture multimedia notes effortlessly. In Joplin you can : • create manuscript notes, • transcribe speech to note, • add multimedia: photos, videos, PDFs, and images, • insert documents as attachments, • create math expressions, add tables, write code and insert diagrams, • create to-dos and add reminders. Organise your ideas Organise your notes into notebooks. Connect your notes with tags by subject or priority. Use colours and rich text editor to format your notes with ease. Make task lists, create to-dos and add reminders. Effortlessly find your notes, even within PDFs and images, thanks to the powerful search feature enhanced by Optical Character Recognition (OCR) technology. Use Joplin to store your bills, lecture notes, photos or receipts. Reliable synchronisation Access your notes from computer, phone or tablet by synchronising with various services including Joplin Cloud, Dropbox and OneDrive. Seamlessly move from one device to another. Offline-first You can access your notes anytime and anywhere, even without Internet. If you’re using Joplin on multiple devices, they will synchronise and update once you regained the connection. Enhance your productivity across devices Extend your note-taking experience by using Joplin on additional devices such as a desktop computer or tablet. Make the most of each device by using its specific features. On the desktop app, use a web clipper extension, wide-range of community plugins and a Markdown editor. Experience flawless handwriting and drawing on your tablet. Join active community Connect with Joplin’s vibrant community on Joplin Forum. It’s a place where users can share ideas, ask questions, exchange information and give feedback. Joplin’s dynamic community also develops powerful plugins, so you can customise your app to suit your needs.

Rating

Rated 4.14 out of 5 stars by 473 users

Version Info

Current Version13.7.4
Last Updated05 Sept 26
First Released21 Nov 17
Minimum iOS Version15.6
Device Models Supported127

App Details

IPA Size72.62 Mb
PriceFree (USD)
Age Advisory4+
Supported Languages1
DeveloperLaurent Cozic
Bundle IDnet.cozic.joplin

Screenshots

Joplin Docker

Container Info

Joplin

[Joplin](https://joplinapp.org/) is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks.

#Content Management

View on DockerHub

linuxserver/joplin:latest

Run Command

docker run -d \
  -p 3000:3000/tcp \
  -p 3001:3001/tcp \
  -e PUID=${PUID} \
  -e PGID=${PGID} \
  -e TZ=${TZ} \
  -v /srv/lsio/joplin/config:/config \
  --restart=unless-stopped \
  linuxserver/joplin:latest

Compose File

version: 3.8
services:
  joplin:
    image: "linuxserver/joplin:latest"
    ports:
      - "3000:3000/tcp"
      - "3001:3001/tcp"
    environment:
      PUID: 1000
      PGID: 1000
      TZ: Etc/UTC
    volumes:
      - "/srv/lsio/joplin/config:/config"
    restart: unless-stopped

Environment Variables

Var NameDefault
PUID1000
PGID1000
TZEtc/UTC

Port List

3000:3000/tcp
3001:3001/tcp

Volume Mounting

Container PathHost Bind
/config/srv/lsio/joplin/config

Joplin Reviews

More Digital Notes

Cryptee
(Web, Windows, Mac OS, Linux, PWA)
crypt.ee
Private & encrypted rich-text documents. Cryptee has encryption and anonymity at its core, it also has a beautiful and minimalistic UI. You can use Cryptee from the browser, or download native apps. Comes with many additional features, such as support for photo albums and file storage. The disadvantage is that only the frontend is open source. Pricing is free for starter plan, $3/ month for 10GB, additional plans go up-to 2TB.

No Security AuditNot Open Source cryptee/web-client
View Cryptee Report
Logseq
(Windows, MacOS, Linux, Android, iOS, Web)
logseq.com
Privacy-first, open-source knowledge base that works on top of local plain-text Markdown and Org-mode files. Supports lots of different note modes, including task management, PDF annotation, flashcards, whiteboards strong markdown support and more. Includes themes and extensions, backed by a strong community

No Security Audit Open Source logseq/logseq
View Logseq Report
Notable
(Windows, MacOS, Linux)
notable.md
An offline markdown-based note editor for desktop, with a simple, yet feature-rich UI. All notes are saved individually as .md files, making them easy to manage. No mobile app, built-in cloud-sync, encryption or web UI. But due to the structure of the files, it is easy to use your own cloud sync provider, and additional features are provided through extensions.

No Security Audit Open Source notable/notable
View Notable Report
Obsidian
(Windows, MacOS, Linux, Android, iOS, Web)
obsidian.md
A powerful knowledge base that works on top of local plain-text Markdown files. It has a strong community, and a lot of plugins and themes. Generally privacy-respecting, but no encryption out of the box, and some of the code is obfuscated or not fully open source

Security AuditedNot Open Source obsidianmd/obsidian-releases
View Obsidian Report
Poznote
(Web (self-hosted, Docker))
poznote.com
Self-hosted notes and tasks app with rich-text, Markdown and drawing editors, tags, multi-user, OIDC login and a REST API. Docker-based (PHP + SQLite); the only outbound call is a daily update check. No mobile apps (PWA), no end-to-end encryption.

No Security Audit Open Source timothepoznanski/poznote
View Poznote Report
Standard Notes
(Web, Windows, Mac OS, Linux, Android, iOS)
standardnotes.com
S.Notes is a free, open-source, and completely encrypted private notes app. It has a simple UI, yet packs in a lot of features, thanks to the Extensions Store, allowing for: To-Do lists, Spreadsheets, Rich Text, Markdown, Math Editor, Code Editor and many more. You can choose between a number of themes (yay, dark mode!), and it features built-in secure file store, tags/ folders, fast search and more. Standard Notes is actively developed, and fully open-source.

Security Audited Open Source standardnotes/app
View Standard Notes Report
Turtle
(Linux, MacOS, Windows, Android (iOS and web in development))
turtlapp.com
A secure, collaborative notebook. Self-host it yourself, or use their hosted plan (free edition or $3/ month for premium).

Security Audited Open Source turtl/desktop
View Turtle Report
VNote
(Windows, MacOS, Linux)
app.vnote.fun/en_us
A free, open-source note-taking application built with Qt, focused on providing a pleasant Markdown editing experience. It manages notes directly as plain text files on your local system.

Open Source vnotex/vnote
View VNote Report

About the Data: Joplin

Change History

Amended Apr 17, 2024 (androidApp, iosApp, subreddit)

Edit Joplin Data

You can edit Joplin's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external sources, a list of these can be found data documentation.

Origin Data

Modify Data

Delete Joplin Submit Edit to Joplin Add alternative

API

You can access Joplin's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/joplin

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Joplin

Help your friends compare Digital Notes, and pick privacy-respecting software and services.
Share Joplin and Awesome Privacy with your network!

← Previous

Notable

View Digital Notes (9)

Logseq

Joplin

Avoid

Also Consider

Joplin Privacy Policy

Privacy Policy Summary

Score

Documents

About the Data

Joplin Source Code

Author

Description

Homepage

Repository

Language Usage

Project Health

Top Contributors

Recent Commits

Joplin Security

Repo Security Summary

Security Advisories (32)

Joplin Website

Website

Redirects

Security Checks

Server Details

Associated Countries

Safety Score

Trackers

Blacklist Check

Website Preview

Joplin Android App

APK Info

De-Googled Compatibility

Trackers

Permissions

Joplin iOS App

App Info

Rating

Version Info

App Details

Screenshots

Joplin Docker

Container Info

View on DockerHub

Run Command

Compose File

Environment Variables

Port List

Volume Mounting

Joplin Reviews

More Digital Notes

Cryptee

Logseq

Notable

Obsidian

Poznote

Standard Notes

Turtle

VNote

About the Data: Joplin

Change History

Edit Joplin Data

Origin Data

Modify Data

API

Share Joplin