A single-window encrypted notepad for Windows, in about 150 KB of pure Win32 C++. No runtime to install, no framework, no dependencies beyond Windows itself.
It is a scratchpad for the things you paste between other windows: a token you need for the next command, a row out of a spreadsheet, a paragraph out of a PDF. It encrypts what you leave in it, captures what you copy, tells you where each capture came from, and gives you the tools to clean the mess up.
A friend built a small secure notepad and asked what language to use for the smallest, fastest possible build. This is the answer, worked through: a minimal version first, then a full one, both plain Win32 with a statically linked CRT.
| Binary | Notes | |
|---|---|---|
v1-minimal |
~107 KB | One window, encrypted save, secure wipe. Nothing else. |
v2 |
~149 KB | Everything below. |
For comparison, the same app built with a modern UI framework lands at roughly 3 to 10 MB, and a self-contained .NET build at 60 MB or more.
Encrypted at rest. Notes are sealed with Windows DPAPI, so a file only decrypts for the Windows account that wrote it. No password to manage, and no key material anywhere in the app. Saves are atomic: write a temp file, flush it, then a write-through rename, so a crash or a power cut cannot leave a half-written note.
It survives a power cut. The note is autosaved to
%LOCALAPPDATA%\SecureScratchpad\session.ssp two seconds after you stop
typing, with a fifteen second ceiling so continuous typing still gets flushed,
and restored automatically on the next launch. Nothing to click. Clear deletes
the saved copy immediately, and the whole behaviour can be switched off.
Clipboard auto-capture with provenance. While it is running, anything you copy anywhere on the machine is appended under a header naming the time and the source:
----- clipboard 14:32:05 | Google Chrome | https://docs.example.com/api/tokens -----
tokens expire after 90 days
----- clipboard 14:33:41 | Microsoft Word | Quarterly Report.docx -----
revenue was up 12 percent
The URL comes from the clipboard's own HTML Format data, which is what
browsers populate on a copy, so you get the exact page rather than just the
app name. For documents it uses the source window title, with the app's own
name trimmed off the end. The clipboard owner decides which app is
credited, and a window title is only borrowed from the foreground window when
it belongs to that same process, so a capture is never mislabelled with an
unrelated window's title.
Find and replace, with regular expressions, preserve-case replacement, a
live match count and search within a selection. The regex engine is written
from scratch rather than pulling in std::regex, which would have cost more
binary than the rest of the app put together.
A Text menu for normalising pasted data. Twenty transforms that work on the selection or the whole note, each a single undoable edit. Clean pasted text (Ctrl+Shift+K) does the common pass in one go: strip invisible characters, straighten curly quotes and long dashes, trim trailing whitespace, collapse runs of blank lines. Then there is sort, dedupe, join a column into a comma list, unwrap PDF hard-wrapping, tabs and spaces, and case conversion.
A password generator and an API token creator, both drawing from
BCryptGenRandom and selecting characters by rejection sampling so there is
no modulo bias.
The other security bits. Copy and cut are excluded from Windows clipboard history and cloud clipboard sync. The window can be hidden from screenshots and screen shares. Clear zeroes the edit control's real internal buffer rather than just blanking the text. Single instance, per-monitor DPI aware, CFG, DEP and ASLR on.
Needs Visual Studio Build Tools with the C++ workload. Nothing else.
cd v2 && ./build.cmdThat produces SecureScratchpadV2.exe and selftest.exe. The self-test is a
console program covering the crypto round-trip, the RNG distribution, the
password and token generators, the regex engine and every text transform:
./selftest.exeselftest.exe dump note.ssp decrypts a saved note to stdout, which is also
how the test suite proves that what was typed is what came back.
- Auto-capture is indiscriminate, and it persists. Copy a password out of your password manager while this is open and it lands in the note, is written to disk within two seconds, and comes back on every launch. The two headline features compound. Ctrl+Shift+C stops the capturing; Security > Keep note across restarts stops the storing; Clear removes both.
- DPAPI ties a note to one Windows account on one machine. That is what buys you no password prompt. It also means there is no way to open a note anywhere else, and no recovery if the profile is gone.
- While the app is open the text is ordinary process memory. An administrator or a debugger on the same machine can read it, and pages can be swapped to disk. Wiping happens on Clear and on close.
- The clipboard is plain text for other apps. That is what paste is. Only history and cloud retention are suppressed.
- This is not a password manager. It is a scratchpad that happens to be encrypted at rest.
v1-minimal/ the smallest useful version, ~107 KB
v2/ the full app, ~149 KB
docs/ screenshots
Each version has its own README with the detail.
MIT. See LICENSE.