How iPhone locks a note, and what the lock leaves out.

Locking a note on an iPhone takes about 4 taps and genuinely works. Here's how to do it, and then the more useful question, which is what the lock never covered in the first place.

There's a lock built into the iPhone Notes app and it takes about 4 taps to reach. Most people never go looking for it.

Here's the whole job. Open the note you want to lock. Tap the More button, the 3 dots at the top right. Tap "Lock". Your iPhone will either use the passcode you already have or offer to set a separate Notes password, and from then on Face ID opens that note the way it opens everything else on the phone.

That's it. I wanted to put that first, because it's what you came for, and because the how was never the interesting bit. What the lock covers, and what it quietly doesn't, is where this gets useful.

The lock is better than you'd expect

I'll give Apple full credit, this is not security theatre.

A locked note is encrypted end to end with a key derived from your passcode or your Notes password. The copy sitting on Apple's servers is unreadable to Apple. Not "protected by policy", not "access restricted to authorised staff", actually unreadable. And you can prove it to yourself, because if you lock a note and lose the password, Apple can't get it back for you. That inability is the whole demonstration. A company can only return what it's able to read.

Think of it as the little safe bolted to the wardrobe floor in a hotel room. It's a real safe. Whatever you put in it is genuinely yours for the week.

It only holds what you remembered to put in it

Which is the first gap, and it's a big one, because the safe is opt-in and it works note by note.

Every note starts unlocked. Locking is a decision you have to make, on purpose, one note at a time, and the notes that most need it are exactly the ones you're least likely to stop and lock. The address you typed while walking. The thing the doctor said, tapped out in the car park before you forgot it. The password you told yourself you'd move into a proper manager later. Those get dashed off in 10 seconds and nobody dashes off a 10 second note and then goes hunting through a menu for the lock.

So the safe is excellent and mostly empty, while the good stuff is on the bed, the desk and the bathroom shelf, where you left it.

The title is written on the outside

Lock a note and the body disappears from the list. The title doesn't.

That's deliberate, you need some way of telling your locked notes apart, and I can see why they built it that way. But a title is not nothing. "Solicitor, Thursday" tells a story on its own. So does "results" and so does anyone's full name. The lock hides the contents of the envelope and leaves the address showing, which is fine right up until the address was the sensitive part.

Everything else in the room

Here's the part that matters most and gets discussed least. Your unlocked notes, which is to say almost all of them, sit in iCloud encrypted in a way that Apple holds the key to.

That was always true, and for years there was a way out of it. Advanced Data Protection turned iCloud into a system where Apple no longer held the key, and if you're outside the UK it's still there and still worth switching on. If you're in the UK, Apple withdrew it rather than build the access the Home Office asked for, so the option simply isn't on your phone any more. I've written about what Apple can and can't read in more detail, and the short version is that the answer changed and nobody sent you a letter about it.

Housekeeping walks through the room twice a day. It always did. The safe was never the thing standing between them and your stuff.

Reminders were never in the deal

One more, and it surprises people. The lock lives in Notes. Reminders has nothing equivalent.

Your reminders carry a fair amount about you, when you take medication, who you're meant to ring back, the appointment you've moved 3 times. There's no lock to find in that app because there isn't one, and the same goes for the tasks buried in other people's apps that sync somewhere you've never looked.

What I'd rather have, and why I'm building it

I kept arriving at the same conclusion, which is that a lock you have to remember is a lock that fails on the days you're busy, and busy is when you write most.

Catchlight encrypts everything, on the phone, before it's written to disk, with a key derived from 12 words handed to you the first time you open it. There's no per-note decision to forget, because there's no unlocked state to fall back into. Notes, tasks and reminders sit in the same encrypted item rather than in 3 apps with 3 different answers on privacy. There's no account, so there's nothing at my end to reset, and no key in a drawer at my shop. If you want the longer version of why that matters, it's who holds the key, and the comparison with Apple Notes lines the two up on this exact point.

It's not out yet. It's coming soon, on iPhone, and the waitlist gets 30 days free rather than 14 when it lands.

None of which means you shouldn't lock your notes today. Go and lock them, it takes 4 taps and the lock is good. Just know what you've locked, and go and have a look at what you left on the bed.

If you want the other half of that, what open source actually buys you covers the part of a privacy claim an app can't prove on its own.