Is there a real way to require a password to open my notes, or is the plugin that asks for one just theatre?

The point about encrypted notes not being searchable deserves more weight, because it undermines the reason most people use these apps.

If you encrypt a note, it is opaque to search, to backlinks, to the graph and to every query. So the encrypted notes become a separate silo that does not participate in your system — which is fine if there are three of them and hopeless if there are three hundred.

That is usually the deciding factor. If the sensitive material is a small, self-contained set, per-note encryption or a separate encrypted vault works well. If it is scattered through notes you use daily, protect the whole machine instead and do not try to encrypt selectively.

You are right, and it is worth being precise about it because the distinction decides which solution you need.

A password prompt in a notes app is access control inside that app. It stops somebody who picks up your open laptop from browsing your notes in the app. It does not stop anybody from opening the folder in a file manager, or a text editor, or from a terminal, because the notes are exactly what they appear to be: markdown files in a directory.

That is not a criticism of those plugins — it is what they are for, and a deterrent against casual over-the-shoulder access is a legitimate thing to want. It is simply not encryption, and the danger is assuming it is.

What actually protects the content, in increasing order of effort:

1. Full-disk encryption. Almost certainly the right answer for your situation. Every mainstream operating system has it built in, it is a setting rather than a project, and it protects everything on the machine — not just notes. It defends against the laptop being lost or stolen, which is the realistic threat for most people.

What it does not do is protect against somebody using your account while you are logged in, because once the machine is unlocked the disk is decrypted. If your concern is a shared laptop with a shared login, this alone does not solve it.

2. Separate user accounts on the shared machine. Boring and effective. If the other person has their own account, your files are not readable from theirs, and combined with disk encryption that is a genuinely solid arrangement for a shared laptop. This is the answer to your actual problem.

3. An encrypted container or volume for the sensitive vault. A file that mounts as a drive when you supply a passphrase, and is an opaque blob otherwise. Keep the sensitive notes in there, mount it when you need them, unmount when you are done. More friction, genuinely encrypted at rest even while you are logged in.

4. Per-note encryption via a plugin. Some plugins encrypt individual notes' contents rather than gating the app. The file on disk really is ciphertext. This is real protection for those specific notes.

The trade-offs are significant, though: encrypted notes are not searchable, not indexable by your query plugins, and if the plugin is abandoned or you lose the passphrase, the content is gone. Test recovery before you trust anything to it — encrypt a note, then verify you can decrypt it from a fresh install.

One thing to watch across all of these: sync and backups. If your vault syncs to a service, encryption on your laptop does nothing about the copy on the server unless the sync itself is end-to-end encrypted. Check what your sync arrangement actually does, because that is where the copy you have thought about least is sitting.

My recommendation for what you described: separate accounts plus full-disk encryption. Both are free, both are settings rather than plugins, neither adds daily friction, and together they cover the shared-laptop case properly. Reach for an encrypted container only if there is something you would not want read even by someone with your login.

Whichever route you take, work out the recovery story first and write it down somewhere that is not inside the thing being protected.

I have watched somebody lose a year of notes to an encrypted container whose passphrase lived only in their head, after a break. There is no support line for that.

So: passphrase in a password manager, and a tested recovery path. And check your backups actually capture the encrypted vault in a restorable form — a backup of a mounted volume and a backup of the container file are different things, and only one of them restores.

Small practical addition for the shared-laptop case: even with separate accounts, check what your notes app leaves outside the vault folder.

Recently-opened lists, window state, plugin caches, search indexes and crash logs live in application data, and some of them contain note titles or fragments of content. Under separate user accounts that is all inside your profile and therefore protected — but if you are relying on an encrypted container inside a shared account, those crumbs are outside it.

Does not change the recommendation, just worth knowing that the vault folder is not always the only copy.