Locked out of Notes Password (if forgotten)

Apple has no access to your Notes password, your AppleID password, your device screen lock code nor any other password or passcode you use.

Passwords you use are encrypted, even if in iCloud Keychain. The encryption keys are tied to your device and your AppleID password, so no, Apple cannot access or decrypt and read those.

Apple can help someone reset their AppleID password since it is stored, encrypted on their system and thus they can delete the password (they cannot read it) and allow you to reset it. But Apple cannot reset a screen lock passcode for you, nor a notes password, nor can they find and recover your AppleID recovery key if you use one, nor any of the password you use with your apps or store in your iCloud Keychain.

I don’t know where you got the idea that Apple has access to your passwords, but reality is, they do not.

vstelly_ wrote:

I have been trying for the past few weeks to figure out a way back into my locked Note but everyone (including Apple) has been telling me that there is not way back into it.

The notes password is a decryption key, and it either works and decrypts the data, or it fails, and the data remains encrypted.

The decryption key is not stored.

The decryption key is not uploaded to Apple.

Apple used what is considered a secure data encryption algorithm; AES.

Apple also did not provide a means to render the password meaningless, too.

Basically, you are equivalent to the “hacker” here, trying to access the protected data through brute force, and Apple didn’t provide a means to bypass the data encryption.

Nobody yet knows how to create an encryption key escrow scheme without introducing massive security holes, too. Holes that would render the whole of the associated data encryption scheme weak, and vulnerable.

No password and no hint means no access.

PS: passwords are typically hashed when they are stored, and not encrypted. The hash is a one-way hash function, meaning it’s very difficult to get from the password hash back to the password. Any subsequent password challenges will use the candidate password, hash it, and compare it with the saved hash. This means that the cleartext password isn’t stored, and thus cannot leak.

A password that is encrypted—encrypted, and not hashed—can be decrypted, and thus can leak. If that decryption key for the encrypted password store leaks, there’s going to be a Bad Day. A hashed password store does not have that particular problem.

You did not come off aggressively, sorry if my reply implied that. I just was pointing out that Apple really does not have access to your private information such as passwords and passcodes.

Your notes password is known only to you. It is stored in your iCloud account, but as an encrypted password, which only you, using your devices and your AppleID can decrypt. So when you forget it, there is literally nothing Apple can do to reset it.

It’s like your device screen lock passcode. That is strictly stored on the device itself, and in an encrypted form where the Secure Enclave encryption is tied to your device hardware, and your passcode you created. So if you forget it, all you or Apple can do is erase the device. That restores it to the original setup menu so that a wholly new screen lock passcode can be created. But there is no way for Apple to reset or recover it for anyone.

Consider getting a good password management app, like 1Password or mSecure. Those are great tools for recording everything from online account logins to app specific logins, like notes passwords.

Or even just a notebook you write them down in and keep private and secured somewhere if that is necessary. There are all sorts of passwords and passcodes yiu will find there is no resetting of or recovery of. They are your private security codes and if you forget them, you loose access to accounts, or app content or other data. So organizing some means of keeping passwords accessible is necessary.

Apple deliberately designs their software and device so that neither they, nor anyone else, can gain access to your private data. But that means it is incumbent on the user to keep their passwords and passcodes in some form they can recall or recover them when they forget them. It is your data, and Apple has publicly committed to keeping it only accessible to you yourself. But that means you are responsible for your passwords and they cannot recover them for you.