Back to blog

Secure Note Guide

What Not To Put In A Secure Note

A secure note is best for context, recovery plans, and access instructions. It becomes risky when it turns into a second unmanaged copy of passwords, recovery codes, identity proof, or private keys.

The Short Rule

Put the map in the secure note, not every key. A good note says what something is, who owns it, where the trusted copy lives, how access is reviewed, and what to clean up after sharing.

What Not To Store Directly

If you are asking what not to put in a secure note, start with anything that would let someone sign in, reset access, impersonate you, move money, or bypass normal recovery.

  • Raw passwords, master passwords, PINs, passkeys, or unlock phrases unless the note is inside the private vault meant to protect them.
  • Recovery codes, backup codes, seed phrases, private keys, API tokens, SSH keys, and one-time bypass links.
  • Full security-question answers, identity document numbers, payment card details, CVV codes, or bank transfer instructions.
  • Screenshots, exports, or copied blocks from another vault that make the note a second unmanaged copy of the secret.
  • Shared access instructions without an owner, recipient list, review date, and removal plan.

The Duplicate Copy Problem

A password manager can protect one vault item well. Trouble starts when the same secret also exists in a note app, a screenshot, a downloaded text file, a chat thread, and someone else's inbox.

Secure Note Checklist

Use this secure note checklist before you save or share anything sensitive. It keeps the note useful without turning it into a loose pile of secrets.

Safe note review

  • Name the owner and purpose of the note.
  • Say where the real secret lives instead of pasting the secret into every note.
  • Label the sensitivity and who is allowed to open it.
  • Add a recovery contact or role when another person may need it.
  • Set a review date for device, account, ownership, or sharing changes.
  • Delete temporary drafts, downloads, screenshots, and clipboard copies.

Safe Secure Note Template

A safe secure note template points to the trusted place where the real secret lives. It also names the people, timing, and cleanup rules around that secret.

Title
Account recovery plan for [service or device]
Owner
[person or role]
Purpose
Why this note exists and when to use it
Secret location
Private vault item, hardware key, or offline backup location
Do not include
Raw password, recovery code, seed phrase, or identity proof
Allowed readers
Named people only, with removal steps
Review date
Next date to verify access, sharing, and cleanup

Before You Share A Secure Note

Verify the recipient, decide whether they need temporary or ongoing access, and pick a channel with revocation or rotation. If a note contains recovery material, identity proof, or a copied secret, do not send it through email, chat, support tickets, or screenshots.

Keep sensitive access intentional

Passlock for Mac locks important passwords behind time locks, word challenges, and partner keys so access takes a deliberate unlock.

Secure Note FAQ

What not to put in a secure note?

Do not put raw passwords, master passwords, recovery codes, seed phrases, private keys, full identity details, CVV codes, or unmanaged copies of vault exports into a secure note unless that note is inside the trusted vault designed to protect those secrets.

Is it okay to store passwords in a secure note?

Only store passwords in a secure note when the note lives inside your password manager or private vault and is the intended storage place. Do not duplicate passwords into chat, email, shared docs, screenshots, or temporary notes.

What should a secure note checklist include?

A secure note checklist should include owner, purpose, storage location, sensitivity, allowed readers, recovery contact, review date, sharing rules, rotation rules, and temporary-copy cleanup.