Fast, focused writing
A lean plain-text editing experience with no distractions — familiar from day one.
Local-first · Authenticated encryption
Your text, encrypted right on your machine
TextSandbox is a desktop app that helps you write, organize and store content inside Vaults encrypted with XChaCha20-Poly1305, with the Master Password protected by Argon2id. Content is encrypted locally before it is saved to disk or synced off the device.
- XChaCha20-Poly1305
- Argon2id
- Local encryption
Saved
Ln 6, Col 24
142 words · 918 chars
UTF-8
Markdown
Auto-lock 10:00
Why TextSandbox?
Online note apps are convenient, but they usually require an account, a network connection, or handing your data to a provider. Plain text editors, on the other hand, lack organization, version recovery, and protection for many documents inside one workspace. TextSandbox combines the important strengths of both.
Many documents, one Vault
Organize documents by purpose: work, personal notes, research or long-term archives.
Encrypted on your device
Content is encrypted with XChaCha20-Poly1305 authenticated encryption before it is written to disk, instead of sitting there as plain text.
Autosave without the cloud
Local autosave works fully even with Cloud Sync off — the cloud is an optional add-on.
Encryption at the core
Authenticated encryption, performed on your own device
TextSandbox is built around one principle: personal data must be encrypted before it is stored long-term or synced off the device. Every encryption and decryption step happens locally — no server is involved at any point.
Content encryption
XChaCha20-Poly1305
Authenticated encryption (AEAD): it keeps content unreadable and also detects whether encrypted data has been modified. XChaCha20's extended nonce makes it safe to encrypt large numbers of documents and attachments inside a single Vault.
Master Password protection
Argon2id
A memory-hard key derivation function designed to slow down password-guessing attacks using GPUs or dedicated hardware. Your Master Password is never stored — it is only used to derive the encryption key at the moment the Vault is unlocked.
From your text to an encrypted Vault
You write in the workspace
Content only exists in readable form in memory while the Vault is unlocked.
Argon2id derives the key
The encryption key is derived from your Master Password — the password itself is never stored.
XChaCha20-Poly1305 encrypts
Content, titles, history, attachments and workspace state all get authenticated encryption.
Written into the .tsbx file
Only encrypted data reaches the disk — and only that data is ever synced if you enable Cloud Sync.
Inside a .tsbx file
- Document content encrypted
- Document titles encrypted
- Edit history encrypted
- Attachments encrypted
- Workspace state encrypted
- Master Password never stored
- Recovery Key stored offline
Each Vault is a self-contained, encrypted file — easy to back up, move or archive.
- Vault content is encrypted locally before it is saved or synced.
- The Master Password is never sent to the cloud.
- Cloud Sync stores encrypted data only — never readable content.
- The cloud service cannot decrypt your Vault on your behalf.
Important: because no backup key exists outside your hands, losing both the Master Password and the Recovery Key means the encrypted content cannot be recovered.
Highlighted features
From private Vaults and a serious text editor to version history and attachments.
Private Vaults
Each Vault is a standalone .tsbx file. Create several for work, personal notes, research or long-term storage.
A focused editor
Multiple tabs, autosave, undo/redo, multi-cursor, find & replace with regex, word counts and familiar shortcuts.
Organize & find again
Pin, sort, Trash and restore. Recent Documents and Recent Vaults bring you back to what you were working on.
Import, drag & drop, export
Drop files or import whole folders, detect common encodings, export plaintext and create protected Vault backups.
Encrypted version history
Review older content, compare changes and restore a previous version — the history is encrypted too. Deleting a document goes through Trash.
Encrypted attachments
Attachments are stored encrypted next to your text, and decrypted in memory only to preview images, PDFs and some common formats.
Recovery Key & auto-lock
A Recovery Key restores access if you forget the Master Password. The app can lock itself after a period of inactivity.
Multilingual interface
19 interface languages, automatic system-language detection, and light / dark / system appearance.
Optional Cloud Sync
Use the same Vault on several devices — data is encrypted before it leaves the machine and the cloud stores encrypted data only.
How Cloud Sync works
1
Encrypted before leaving the device
Data is encrypted with XChaCha20-Poly1305 on your machine. The cloud never receives your Master Password, Recovery Key or readable content.
2
Incremental syncing
After the first sync, later runs reuse unchanged parts and upload only the encrypted blocks of documents or attachments that changed.
3
No silent overwrites
If two devices change the same document, TextSandbox keeps the conflicting copy for you to review.
4
Safe incoming updates
The app detects newer versions from other devices and pulls data when the workspace is in a safe state to sync.
Optional, never required
Cloud Sync stores encrypted data only
Cloud Sync is for people who want to use the same Vault across devices. Encryption always happens before data leaves your machine, so the server only ever receives unreadable blocks. With Cloud Sync off, TextSandbox still autosaves everything on your device.
- Cloud Sync stores encrypted data only.
- The cloud never receives your Master Password, Recovery Key or readable content.
- The local Vault remains your main workspace when offline.
- A cloud account does not replace the Master Password and cannot decrypt the Vault.
On your machine
# Research notes…
On the cloud
a7f3e1b9…4c2d8e
Cloud plans
Limits are measured as encrypted data stored in the cloud. Encryption is identical on every plan, and using TextSandbox entirely locally does not require any plan at all.
Free
100 MB
Personal notes and trying out Cloud Sync.
- All local features
- Unlimited Vaults on your machine
- Cloud Sync for encrypted notes
Lite
1,000 MB
Everyday work and multiple projects.
- 1,000 MB of encrypted data
- Sync several Vaults
- More room for attachments
Pro
10,000 MB
Large libraries and multi-device use.
- 10,000 MB of encrypted data
- Great for long-term archives
- Many devices, one Vault
Basic workflow
Six steps to get started
From installing the app to safely locking your Vault — everything happens on your device.
When you close the window, TextSandbox saves your edits and workspace state, confirms the Vault is safely locked, and only then exits.
Install and open TextSandbox
A desktop app — no account needed to use it.
Create a new Vault
Choose a strong Master Password and store the Recovery Key somewhere safe and offline.
Create documents
Type your text or drag existing files into the workspace.
Just work
Autosave writes your changes into the local Vault.
Enable Cloud Sync (optional)
Only if you want to use the same Vault on another device.
Lock the Vault when you leave
Or let the app auto-lock after your configured idle time.
Frequently asked questions
What people usually ask about Vaults, Cloud Sync and the scope of protection.
No. TextSandbox is local-first: you can work fully offline and never create an account. Cloud Sync is only an optional add-on for people using multiple devices.
You can use the Recovery Key issued when the Vault was created to regain access. The Recovery Key should be stored offline, separate from the Vault. If you lose both, the content cannot be recovered.
No. Cloud Sync stores encrypted data only. The Master Password and Recovery Key are never sent to the cloud and the encryption key exists only on your device — so the service has no way to decrypt the Vault for you.
Each Vault is a standalone file containing document content, titles, edit history, attachments and workspace state — all encrypted with XChaCha20-Poly1305 before being written to disk. That makes backing up or moving a Vault straightforward: wherever the file goes, it stays encrypted.
Vault content is encrypted with XChaCha20-Poly1305, an authenticated encryption (AEAD) algorithm that both keeps content unreadable and detects tampering. The Master Password is protected with Argon2id, a memory-hard key derivation function designed to slow down password-guessing attacks.
Entirely on your device. The encryption key is derived locally from your Master Password with Argon2id, then content is encrypted before it is written to disk or synced. No step of the encryption process requires a server.
TextSandbox keeps the conflicting version for you to review instead of silently overwriting content. It also only pulls new data when the workspace is in a safe state to sync.
No. TextSandbox protects data while the Vault is locked and when the Vault file is copied off the device. While the Vault is unlocked, content must be displayed so you can work — so the app cannot protect against malware, keyloggers, screen capture tools or a compromised operating system.
Yes. You can export the current document to plaintext after confirming a warning — the exported file is no longer encrypted — or create an encrypted Vault backup to store elsewhere.
Stable release 2.0.4
Start with your first encrypted Vault
Write comfortably, find things again easily, and keep ownership of the content that matters. Download TextSandbox and create a Vault in a couple of minutes.