BlankType

BlankType is a local-first note-taking app built with Electron, React, and TypeScript.

Features

• Rich-text notes and folders
• Pinning, reminders, search, and recently deleted notes
• Local SQLite storage
• Multi-device sync through Google Drive, OneDrive, Amazon S3, or Cloudflare R2
• Optional end-to-end encryption
• Offline editing and conflict resolution
• Light and dark themes

Development

Requirements:

• Node.js 24 or later
• pnpm 11

pnpm install
pnpm dev

Available commands:

pnpm test       # run tests
pnpm check      # format, lint, and type-check
pnpm build      # create production bundles
pnpm package    # create an unpacked desktop application
pnpm make       # create an installer

Cloud sync

Cloud sync is local-first. Edits are saved to SQLite immediately and uploaded after a short idle period. Continuous editing is checkpointed every 30 seconds. Concurrent changes from different devices are kept until the user resolves them.

Only one provider can be active at a time.

Google Drive

Create a Google OAuth desktop client, enable the Drive API, and provide the client ID when building:

BLANKTYPE_GOOGLE_CLIENT_ID=your-client-id pnpm build

The app requests the drive.appdata scope and stores data in the hidden application-data folder.

OneDrive

Register a public desktop application in Microsoft Entra ID with:

• Personal and organizational account support
• A loopback desktop redirect URI
• Delegated Files.ReadWrite.AppFolder permission

Then provide the application client ID:

BLANKTYPE_MICROSOFT_CLIENT_ID=your-client-id pnpm build

No Microsoft client secret is used.

Amazon S3

Use a dedicated IAM identity restricted to the selected bucket and prefix. The app requires:

• s3:ListBucket
• s3:GetObject
• s3:PutObject
• s3:DeleteObject

The default prefix is .blanktype-sync/v1/.

Cloudflare R2

Create a bucket-scoped R2 API token with object read/write access. Enter the account ID, bucket, access key ID, and secret in the application settings.

Security

• OAuth uses Authorization Code with PKCE and the system browser.
• Provider credentials stay in the Electron main process.
• Persisted secrets use Electron safeStorage.
• Encrypted vaults use scrypt and AES-256-GCM.
• Recovery keys are displayed once and are not stored remotely in plaintext.

Cloud providers can still observe object sizes, counts, and update times.

Project structure

electron/   Electron main process, persistence, authentication, and sync
src/        React application
resources/  Application assets

License

MIT