WorkSpace is a private personal workspace for Notes, Files, Documents and Canvas that runs entirely in your browser. Everything stays on your device, is encrypted at rest, and works fully offline as an installable Progressive Web App (PWA).
No accounts in the cloud. No servers. No tracking. Your data never leaves your device.
- Create, edit, pin, favorite, archive, duplicate, and trash notes
- Categories, tags, labels, colors, grid/list view, live word count
- Templates (Journal / Meeting / To-Do), version history, and auto-save
- Import from Google Keep, Apple/iCloud Notes, Evernote (
.enex), HTML/JSON/TXT/MD, or a.zip
- Upload via button or drag & drop (including whole folders, structure preserved)
- Unlimited nested folders with breadcrumb navigation and folder colors
- Preview images, video, audio, PDF, and text/code; rename, duplicate, download
.ziparchives auto-extract on upload; multi-select, sort, search, favorite
- Rich-text editor: headings, bold/italic/underline/strike, lists, checklists, tables, alignment, links, text & highlight color
- Word/char count, reading time, outline navigation, focus mode
- Export to TXT / HTML / Markdown / PDF
- Import Word (
.docx), PowerPoint (.pptx), Excel (.xlsx), HTML/TXT/MD/RTF, or.zip
- Free drawing (pen / brush / marker / eraser), shapes, arrows, text, sticky notes, images
- Pan, zoom, undo/redo, auto-save, version history
- Templates (Whiteboard / Mind Map / Flowchart), export to PNG / JPG / PDF
- Import from Excalidraw (
.excalidraw) or canvas JSON
- Multi-user, fully isolated — each user has a separate database and encryption key
- Encryption at rest: a random 256-bit key (AES-GCM) encrypts every record and file blob
- The key is wrapped by your password (PBKDF2) and optionally a 6-digit PIN
- PIN lock with attempt lockout, auto-lock after inactivity, and one-tap manual lock
- Export / import the whole workspace as JSON (optionally PIN-protected, AES-GCM encrypted)
- Google Takeout import — auto-sorts Keep → Notes, Docs → Documents, the rest → Files
- Unified Favorites, Recent, and Trash (30-day auto-purge) across all sections
- Global search (
Ctrl + K), light/dark theme, browser-style back/forward/up navigation - Installable PWA with app shortcuts and full offline support
WorkSpace is a static web app — no build step, no dependencies.
A service worker is used, so serve over http://localhost (not file://):
# Python (any 3.x)
python -m http.server 8080
# or Node
npx serve .Then open http://localhost:8080 in your browser.
Open the site in Chrome/Edge and click Install in the address bar (or Add to Home Screen on mobile). It then works completely offline.
- Create an account (username + password) — this sets up your encrypted workspace.
- Create a 6-digit PIN to lock/unlock quickly.
- Start adding notes, files, documents and canvases. Everything auto-saves.
⚠️ Your password/PIN is the only way to decrypt your data. There is no recovery — if you lose both, the data cannot be opened. Keep a backup.
| Shortcut | Action |
|---|---|
Ctrl + K |
Open global search |
Esc |
Close search / dialog |
Alt + ← / Alt + → |
Navigate back / forward |
| Mouse back/forward | Navigate back / forward |
Vanilla JavaScript (ES modules), no framework. A lightweight SPA shell routes to feature modules.
WorkShop/
├── index.html # App shell: splash, login, PIN, workspace
├── app.js # Boot, auth gating, SPA router, Home/Settings/Profile
├── style.css # All styles (light/dark themes)
├── sw.js # Service worker (offline + installable)
├── manifest.webmanifest # PWA manifest (icons, shortcuts)
├── assets/ # Logo / icons
├── pages/ # Static HTML fragments per route
└── modules/
├── storage.js # IndexedDB persistence (per-user DB) + LocalStorage helpers
├── crypto.js # Envelope encryption (AES-GCM DEK wrapped by password/PIN)
├── auth.js # Multi-user local auth (salted SHA-256)
├── pin.js # 6-digit PIN, lockout, auto-lock
├── model.js # Shared item model + cross-cutting helpers
├── notes.js # Notes
├── files.js # Files / folders
├── documents.js # Rich-text documents
├── canvas.js # Whiteboard / canvas
├── favorites.js · recent.js · trash.js · search.js · labels.js
├── takeout.js # Google Takeout import
├── backup.js # Workspace export/import (optional encryption)
├── zip.js · office.js # ZIP + Office (docx/pptx/xlsx) extraction
├── theme.js · ui.js # Theming + reusable UI primitives (toast, modal, …)
└── storage / model / etc.
Every item shares a common shape and is stored in its own IndexedDB object store:
{ id, type, title, fav, pinned, trashed, trashedAt,
createdAt, updatedAt, /* …type-specific fields… */ }Records in notes, files, documents, and canvases are transparently encrypted before write and decrypted on read. File blobs are encrypted separately with AES-GCM.
- A random 256-bit Data Encryption Key (DEK) encrypts all records and file blobs.
- The DEK never leaves the device unencrypted. It is wrapped by a Key-Encryption-Key derived from your password (PBKDF2, 200k iterations) and optionally your PIN.
- The DEK lives only in memory + this tab's
sessionStorage. On browser close / lock it is gone — on-disk data stays encrypted until you unlock with the PIN or password.
- 100% local — no network calls for your data; nothing is uploaded.
- Encrypted at rest — notes, files, documents and canvases are AES-GCM encrypted.
- Per-user isolation — one user can never read another's data.
- Offline-first — the app shell is precached; everything works with no connection.
Modern browsers with IndexedDB, Web Crypto, and Service Worker support
(Chrome, Edge, Firefox, Safari, and Chromium-based mobile browsers).
Folder upload/drag-drop uses webkitdirectory where available.
- Vanilla JavaScript (ES modules) — zero runtime dependencies
- IndexedDB for storage, LocalStorage for small fast-access keys
- Web Crypto API (AES-GCM + PBKDF2) for encryption
- Service Worker + Web App Manifest for offline & installability
SURYA — WorkSpace · Private Personal Workspace
WorkSpace keeps your thinking in one private place — notes, files, documents and ideas — encrypted, offline, and yours.