Someone searching "password protect notes Windows" usually has one note in mind. A list of recovery codes, a medical detail, the thing about a colleague that should not be one open laptop away from the colleague. They want that note to ask for a password even while the PC is on and signed in.
Windows does less of this than people expect. Here is what it actually offers, checked against Microsoft's own pages, where each option stops, and then how locked notes work in the app I make. The Mac version covers the same principles; the tools here are different enough to need their own page.
The short answer
- OneNote can put a password on a section of a notebook. Not on a single page, and not on a whole notebook.
- Sticky Notes and Notepad have no password or lock feature at all.
- BitLocker and device encryption protect the disk when the PC is off or stolen. They do nothing against someone sitting at your signed-in PC.
- An encrypted archive made with a tool like 7-Zip works for a file you rarely open. It is clumsy for anything you edit.
- A notes app with per-note locking is the only option on this list that locks one note, and keeps it locked while you are using the computer.
The rest of this post is the detail behind each line.
OneNote: sections, not notes
OneNote is the only notes app Microsoft ships with a real lock. In the desktop app you right-click a section and choose Password Protect This Section, then Set Password. That page applies to OneNote for Microsoft 365 and OneNote 2016 to 2024, which covers the current desktop app. The old OneNote for Windows 10 app is read-only now, so it is not where you should be setting anything up.
It has a few edges worth knowing before you rely on it, all from the same Microsoft page:
The unit is the section. Passwords go on sections only, not entire notebooks, and not individual pages. If you want one page locked, you make a section for it.
Audio and video are not covered. Microsoft says recordings are stored as separate files in the notebook and you cannot apply passwords to them. If you recorded the sensitive conversation rather than typing it, the lock does not reach it.
Locked sections drop out of search. They are not included in notebook searches until you unlock them. That is the correct behaviour (a lock that still answers searches is not a lock), but it catches people out.
It can re-lock itself. Under Options → Advanced → Passwords you can have OneNote lock protected sections after a period of inactivity, or as soon as you navigate away. I would switch on the second one.
A forgotten password is final. In Microsoft's words, not even Microsoft Technical Support could unlock your notes. That is not a support failure, it is what encryption means, and it applies to every option in this post that is worth using.
If you already live in OneNote, this is the answer and you can stop reading here. Make a section called something dull, put the password in your password manager before you close the dialog, and turn on locking when you navigate away. If you are in OneNote only because you assumed it was the only way to lock anything, leaving OneNote covers what moving out involves.
Sticky Notes and Notepad: no lock at all
Neither has one. Microsoft's pages for Sticky Notes describe colours, search, images and syncing through a Microsoft account; there is no password, lock or encryption option anywhere in them. Notepad saves ordinary .txt files, which anyone at your signed-in PC can open.
That is fine for the parking bay number. The mistake is putting recovery codes there because it was the window that happened to be open. What not to write down is a longer argument for keeping some things out of convenient places altogether.
BitLocker and device encryption: the disk, not the note
This is the one people most often think they already have.
Microsoft describes BitLocker as encryption for entire volumes, addressing data theft or exposure from lost, stolen or inappropriately decommissioned devices. That is exactly what it does, and it is worth having. Someone who takes the drive out of your laptop and plugs it into another machine gets nothing readable.
On Windows Home the equivalent is device encryption, which turns BitLocker on automatically for the system drive when you set the PC up with a Microsoft account, or a work or school account. Microsoft's page also says that with a local account, device encryption is not turned on automatically. If you set your PC up without a Microsoft account, check the Device encryption setting in Settings and turn it on yourself. BitLocker Drive Encryption proper, where you choose drives manually, is only on Pro, Enterprise and Education editions.
The limit is the same as FileVault on a Mac: disk encryption protects a PC that is off. Once you have signed in, Windows decrypts the drive for you as you read it, and so does everything running under your account. Someone who borrows your unlocked laptop for five minutes is on the right side of BitLocker.
The same goes for the older file encryption option in a file's Properties → Advanced (not available on Home). It is tied to your Windows account, and Microsoft's own description of it is that decryption is transparent to the user. Transparent to you is transparent to whoever is using your session.
So the other half of this layer is the lock screen. Windows key + L locks your PC. Using it every time you stand up does more for the privacy of your notes than anything else in this post.
An encrypted archive: the DIY route
If you want one file locked and do not want a new app, put it in an encrypted archive.
Windows cannot make one for you. File Explorer compresses to ZIP, and on Windows 11 24H2 to 7z and TAR as well, but Microsoft's zip and unzip page says it does not support operations on encrypted archive files. You need a separate tool. 7-Zip is free and open source, and offers AES-256 encryption in 7z and ZIP formats. Choose 7z with "Encrypt file names" ticked if you do not want the file name itself to give things away.
It is honest encryption, and a bad fit for anything you edit. To change the note you extract it, which writes a plaintext copy to disk, edit it, re-archive it, and must remember to delete the plaintext. Every round trip leaves a readable file behind for a while, sometimes for good. For a document you read once a year, that is acceptable. For a note you add to weekly, it is a leak with extra steps.
Which layer stops whom
Disk encryption stops someone holding your PC while it is off. The lock screen stops someone at your PC while you are away from it. A locked note stops someone already using your unlocked PC. They stack, and none replaces another; the Mac post has a diagram of the same three layers.
How locked notes work in Cyanote
Cyanote is a desktop app for notes, to-dos, a calendar and clipboard history, on your own machine with no account. It started on the Mac and there is now a Windows edition on the Microsoft Store. Any single note can be locked with a password. Here is what that does, taken from the source rather than from memory.
The note is encrypted, not hidden. When you lock a note, its body is encrypted with AES-256-GCM, using a key derived from your password with PBKDF2 (SHA-256, 600,000 iterations for new locks) and a random salt per note. The app then overwrites the readable copy in the database, so what sits on disk is the ciphertext. The database also runs with SQLite's secure-delete setting on, which zeroes freed space instead of leaving old text in it.
The password is not stored anywhere. Not in the database, not in a settings file. When you unlock a note, the derived key is held in memory for that session only. A wrong password does not get compared against anything; the decryption simply fails.
It asks again after a restart. Once unlocked, the note stays open until you choose Lock now from the note's menu or the app restarts. Then it wants the password again. There is no idle timer: unlike OneNote's inactivity option, Cyanote will not re-lock a note because you walked away. That is what Windows key + L is for.
Search does not see inside. A locked note's searchable text is blanked when you lock it, so a word in its body does not turn up in search and there is no preview snippet in the list. Getting that exactly right took a fix I wrote up in the half-second that left a locked note in the clear. The crash-recovery snapshot the app keeps for unsaved typing is also withheld for locked notes, because a plaintext recovery file for an encrypted note is the same leak in a different place.
Backups and exports do not unlock it. A backup copies the database rows as they are stored, so a locked note goes into the backup file as ciphertext. Export to Markdown refuses a locked note outright and asks you to unlock it first, rather than writing either gibberish or your plaintext.
Forget the password and the note is gone. The lock dialog says so before you confirm, and it is true. I cannot recover it, and nothing in the app can. Put the password in your password manager straight away.
The same code on both editions. The locking code has no Windows-specific branch; it is the same code the Mac edition runs. My own hands-on Windows testing covered clipboard history, paste-back, shortcuts, reminders, launch at login and opening text files, so I am telling you what the code does rather than claiming I have sat and tested locking on a PC.
What a locked note does not protect
Stated as plainly as the features:
- The title stays readable. The sidebar has to call the note something. Name it "Bank" rather than "Bank PIN 4471".
- An unlocked note is unlocked. While it is open on your screen, anyone at your screen can read it.
- The clipboard is a separate copy. Copy text out of a locked note and it goes wherever copied text goes, including any clipboard history you use. Clipboard history on Windows covers what each option keeps and for how long.
The setup I would use on a PC
- Check that device encryption or BitLocker is on, especially if you set the PC up with a local account. Keep the recovery key somewhere that is not this PC.
- Press Windows key + L every time you stand up, and set the screen to lock after a few minutes.
- Lock the few notes that warrant it, in OneNote sections or a notes app that locks single notes. Not everything; a notes app where every page wants a password is one you stop using.
- Store each password in your password manager before you close the dialog.
- Back up. Encryption adds new ways to lose things for good, and a local app has no server copy to fall back on. Backing up local notes covers how, and where to keep the things you must not lose covers which things belong in a notes app at all.
If you want one app for it
Locking is the one thing people ask for after the basics; the basics are in a notes app for Windows that never asks you to sign in, and plain .txt and .md files in Markdown and text files on Windows.
If OneNote's sections are more notebook than you need and a sticky note is less, Cyanote locks individual notes as described above, alongside to-dos, a calendar and a clipboard history, with no account and no sync. It is on the Microsoft Store for $7.99, once, and needs Windows 10 or later. It is a separate purchase from the Mac version, which is sold directly. If you use both a Mac and a PC, one notes app on a Mac and a PC explains how that works without sync.