Solved Windows 11 Notepad now automatically saving plaintext versions of encrypted text files

Boyd851 · Oct 4, 2023

I keep a RAR encrypted version of my Passwords.txt file. I don't ever save its plaintext version. However I've discovered that the new automatic save feature of the new tabbed version of Notepad does just that, which of course I don't want. Specifically what happened was that I decrypted my passwords file and its plaintext opened in Notepad by default as usual. When I had finished working with it I closed Notepad (but not the tab). When I next opened Notepad I was astonished to discover the plaintext version of my passwords file available in a tab.

I can't find where Microsoft is storing this file so I can wipe delete it. I gather it's kept in the Temp folder of AppData/Local but I couldn't find it. Anyone help?

In general what is the best way to cope with this extraordinary unwanted behaviour? I may have to switch my default text editor away from Notepad, though I've been using Notepad since the beginning of Windows.

I would like to see the Microsoft engineer responsible for this let go.

antspants · Oct 4, 2023

See if this helps. Also, I can only guess that it would just be a temp file.

Turn On or Off Automatically Save Session State for Notepad in Windows 11 Tutorial

This tutorial will show you how to turn on or off Notepad automatically saving the session state for your account in Windows 11. Notepad is a fast and simple text editor that can be used to view, edit, and search through plain text documents instantly. Starting with the Notepad version...

www.elevenforum.com

Free Up Drive Space in Windows 10

How to Free Up Drive Space in Windows 10

www.tenforums.com

4 Ways to Delete Temporary Files on Windows 11

If you want to reclaim drive space, a good option is to delete temporary files on your Windows PC. Here are four ways to do it on Windows 11.

www.groovypost.com

Boyd851 · Oct 4, 2023

antspants said:
See if this helps. Also, I can only guess that it would just be a temp file.

Turn On or Off Automatically Save Session State for Notepad in Windows 11 Tutorial

This tutorial will show you how to turn on or off Notepad automatically saving the session state for your account in Windows 11. Notepad is a fast and simple text editor that can be used to view, edit, and search through plain text documents instantly. Starting with the Notepad version...

www.elevenforum.com

Free Up Drive Space in Windows 10

How to Free Up Drive Space in Windows 10

www.tenforums.com

4 Ways to Delete Temporary Files on Windows 11

If you want to reclaim drive space, a good option is to delete temporary files on your Windows PC. Here are four ways to do it on Windows 11.

www.groovypost.com

Thanks so much for this. Problem solved, though I'm still uneasy there's a plaintext version of that file floating away somewhere in my system. I did wipe-delete the entire AppData\Local\Temp folder so hopefully that's sorted. Thanks again. Really appreciated.

antspants · Oct 4, 2023

Boyd851 said:
Thanks so much for this. Problem solved, though I'm still uneasy there's a plaintext version of that file floating away somewhere in my system. I did wipe-delete the entire AppData\Local\Temp folder so hopefully that's sorted. Thanks again. Really appreciated.

You’re welcome. Really, it’s @Brink who needs to be thanked. His tutorials are often life saving

antspants · Oct 4, 2023

Regarding the original file you were worried about.
If notepad was saving it as the “last entry” If it ever happens again, delete all the content and replace it with gibberish. That way, on next opening of notepad, the gibberish would of been saved and the original text overridden?
Or, save the text file, close it. Delete the txt file, it shouldn’t come back as a saved state.

Boyd851 · Oct 4, 2023

antspants said:
Regarding the original file you were worried about.
If notepad was saving it as the “last entry” If it ever happens again, delete all the content and replace it with gibberish. That way, on next opening of notepad, the gibberish would of been saved and the original text overridden?
Or, save the text file, close it. Delete the txt file, it shouldn’t come back as a saved state.

Yes, I'll do that next time as standard practice. Excellent tip. Something I tried was uninstalling new Notepad and restoring the classic Notepad.exe, which can still be found in the Windows folder as default. But Windows 11 won't let let you set classic Notepad as default even after you have uninstalled new Notepad. Thanks again.

memo09 · Oct 18, 2023

If in the near future the exact store location of the automatic saved notepad is known, please mention it here. Because I have the same experience, not knowing that autosave function was enabled initially. For me it means, somewhere scattered on my harddrive is a temporary Bitlocker restore key in plain text. I have deleted all temp directories mentionned in the posts above, but still Notepad is somehow able to restore my Bitlocker keys upon restart of Notepad. I use Veracrypt (encrypted volume) as the store location, but Notepad still recovers the TXT somehow after locking the Veracrypt volume. Very dangerous.

memo09 · Oct 18, 2023

Update: I found the location by asking ChatGPT. I checked and the information is legit.
C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
In the above directory (insert your own username) a .binfile is created, which contain the plain text of the autosave file.
You can delete the contents of this directory. I hope some other users find information useful.
Update2: I detected that the bin-file in the TabState directory will be automatically deleted by the app if you select the Notepad setting to "When notepad starts do open a new window" instead of "open the previous session". So the developers had some sense of security in mind.

barreleye · Oct 18, 2023

Boyd851 said:
I keep a RAR encrypted version of my Passwords.txt file. I don't ever save its plaintext version. However I've discovered that the new automatic save feature of the new tabbed version of Notepad does just that, which of course I don't want. Specifically what happened was that I decrypted my passwords file and its plaintext opened in Notepad by default as usual. When I had finished working with it I closed Notepad (but not the tab). When I next opened Notepad I was astonished to discover the plaintext version of my passwords file available in a tab.

How are you getting the plaintext version into Notepad? I use WinRAR, and I don't see how to get the plaintext version of a file out of an encrypted archive except to extract it to disk. If you use WinRAR's internal viewer, it extracts it to the temp folder, and in typical sloppy fashion, doesn't delete it when you exit the program. If you do delete it, you need to use a secure method to prevent someone recovering it using special software, and I don't think that necessarily works if you're using an SSD.

So, two things, with the second being the more pertinent:

1. Must you use Notepad? Notepad++ is infinitely better. The portable version goes in my C:\bin on every computer. There are instructions here on replacing Notepad:

Other Resources

Notepad Replacement Notepad is a default text editor shipped with Windows. You may want to use Notepad++ instead of Notepad. However, there’s no obvious way to do it: You can run commands to edit the registry following command to make Notepad++ replace Notepad (run in cmd.exe with Administrator...

npp-user-manual.org

2. Must you use an ad hoc method of storing passwords that relies on multiple pieces of software not designed for that purpose? Software like Keepass is free and open source and allows you to use local storage. There are compatible versions for iOS and Android that also allow you to use local storage on those devices. This class of software at least thinks about minimizing data leakage, while the new Notepad does not, nor does the internal viewer for WinRAR.

memo09 said:
If in the near future the exact store location of the automatic saved notepad is known, please mention it here. Because I have the same experience, not knowing that autosave function was enabled initially. For me it means, somewhere scattered on my harddrive is a temporary Bitlocker restore key in plain text. I have deleted all temp directories mentionned in the posts above, but still Notepad is somehow able to restore my Bitlocker keys upon restart of Notepad. I use Veracrypt (encrypted volume) as the store location, but Notepad still recovers the TXT somehow after locking the Veracrypt volume. Very dangerous.

No idea what the new Notepad is doing, but my suggestion going forward is to avoid potential problems like that as described above. FWIW, all my drives are Bitlockered, and I store my keys in plaintext on them, so I wouldn't care about your particular data leak. I take that back. My Aegis Secure Keys I use as USB key drives are not Bitlockered, but they're protected with a 10 digit passcode and AES-256, so same difference.

Boyd851 · Oct 19, 2023

memo09 said:
Update: I found the location by asking ChatGPT. I checked and the information is legit.
C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
In the above directory (insert your own username) a .binfile is created, which contain the plain text of the autosave file.
You can delete the contents of this directory. I hope some other users find information useful.
Update2: I detected that the bin-file in the TabState directory will be automatically deleted by the app if you select the Notepad setting to "When notepad starts do open a new window" instead of "open the previous session". So the developers had some sense of security in mind.

View attachment 74651

Many thanks for this. Amazing that we have to use ChatGPT to pin down the location. I checked your info and it's accurate. MIcrosoft really should warn us about this. Notwithstanding the stirctures in the next post I bet there loads of users blithely using WinRar to encrypt text files in Notepad quite unaware that its default behaviour is now to store updates in internal storage. Very dangerous as you say.

Boyd851 · Oct 19, 2023

barreleye said:
How are you getting the plaintext version into Notepad? I use WinRAR, and I don't see how to get the plaintext version of a file out of an encrypted archive except to extract it to disk. If you use WinRAR's internal viewer, it extracts it to the temp folder, and in typical sloppy fashion, doesn't delete it when you exit the program. If you do delete it, you need to use a secure method to prevent someone recovering it using special software, and I don't think that necessarily works if you're using an SSD.

So, two things, with the second being the more pertinent:

1. Must you use Notepad? Notepad++ is infinitely better. The portable version goes in my C:\bin on every computer. There are instructions here on replacing Notepad:

Other Resources

Notepad Replacement Notepad is a default text editor shipped with Windows. You may want to use Notepad++ instead of Notepad. However, there’s no obvious way to do it: You can run commands to edit the registry following command to make Notepad++ replace Notepad (run in cmd.exe with Administrator...

npp-user-manual.org

2. Must you use an ad hoc method of storing passwords that relies on multiple pieces of software not designed for that purpose? Software like Keepass is free and open source and allows you to use local storage. There are compatible versions for iOS and Android that also allow you to use local storage on those devices. This class of software at least thinks about minimizing data leakage, while the new Notepad does not, nor does the internal viewer for WinRAR.

No idea what the new Notepad is doing, but my suggestion going forward is to avoid potential problems like that as described above. FWIW, all my drives are Bitlockered, and I store my keys in plaintext on them, so I wouldn't care about your particular data leak. I take that back. My Aegis Secure Keys I use as USB key drives are not Bitlockered, but they're protected with a 10 digit passcode and AES-256, so same difference.

Many thanks for this. Apreciated.

I've used my Passwords.txt file for the past ten years, before I think these password maintenance programs were developed. Notepad++ is now the default in Windows 11. You can uninstall it and endeavour to use classic Notepad (which isn't tabbed and autosaved in the way Notepad++ now is) and which can still be found in Windows, but Windows 11 won't let you set up a file association for classic Notepad which makes the endeavour not very viable.

Regarding WinRar's View facilty, I do use this when I merely want to view a password, but when I want to edit the file I naturally have to extract it to an editor, but without saving to disk of course. It's precisely because Notepad++ is now autosaving to disk that the problem arises. I wasn't aware WinRar extracted its View file to a temp folder and will have to check that out, and that would be right about the problem of secure deleting it. A similar problem arises when you download a file to (say) the Downloads folder. When you move this file to its final destination it is in fact copying it over and deleting (but now secure deleting) the original file in the Downloads folder. The WinRar shell allows you to move with wiping.

I don't have any massively sensitive files such as say personal diaries and the like. But it's clear that opening such files in Notepad++ is now not a very secure option without careful preparation.

Boyd851 · Oct 19, 2023

Boyd851 said:
Many thanks for this. Apreciated.

I've used my Passwords.txt file for the past ten years, before I think these password maintenance programs were developed. Notepad++ is now the default in Windows 11. You can uninstall it and endeavour to use classic Notepad (which isn't tabbed and autosaved in the way Notepad++ now is) and which can still be found in Windows, but Windows 11 won't let you set up a file association for classic Notepad which makes the endeavour not very viable.

Regarding WinRar's View facilty, I do use this when I merely want to view a password, but when I want to edit the file I naturally have to extract it to an editor, but without saving to disk of course. It's precisely because Notepad++ is now autosaving to disk that the problem arises. I wasn't aware WinRar extracted its View file to a temp folder and will have to check that out, and that would be right about the problem of secure deleting it. A similar problem arises when you download a file to (say) the Downloads folder. When you move this file to its final destination it is in fact copying it over and deleting (but now secure deleting) the original file in the Downloads folder. The WinRar shell allows you to move with wiping.

I don't have any massively sensitive files such as say personal diaries and the like. But it's clear that opening such files in Notepad++ is now not a very secure option without careful preparation.

I found this about WinRar's temp files noting an option to secure delete them when closing WinRar Does WinRAR leave traces of temporarily extracted files?.

Fabler2 · Oct 19, 2023

With 7-zip there is a box to tick to remove original file on compressing/password protecting. With Notepad, if it's set to default setting, if you close the tab/s rather than using the close button (X) then it's not saved.

barreleye · Oct 19, 2023

Boyd851 said:
Many thanks for this. Apreciated.

I've used my Passwords.txt file for the past ten years, before I think these password maintenance programs were developed. Notepad++ is now the default in Windows 11. You can uninstall it and endeavour to use classic Notepad (which isn't tabbed and autosaved in the way Notepad++ now is) and which can still be found in Windows, but Windows 11 won't let you set up a file association for classic Notepad which makes the endeavour not very viable.

The password manager I mentioned, KeePass, has been around since at least 2004, which is when I started using it.

The editor I mentioned, Notepad++, is a totally different program than Microsoft's Notepad, and far superior to it in every way. Here's a link to its home page:

Notepad++

notepad-plus-plus.org

Regarding WinRar's View facilty, I do use this when I merely want to view a password, but when I want to edit the file I naturally have to extract it to an editor, but without saving to disk of course.

See, I don't know how you "extract it to an editor, but without saving to disk". If you're talking about drag and drop from WinRAR to an editor or double-clicking a file in WinRAR, it's still extracting it to the temp folder.

Boyd851 said:
I found this about WinRar's temp files noting an option to secure delete them when closing WinRar Does WinRAR leave traces of temporarily extracted files?.

Thanks, I didn't know about that option. However, reading the comments at the page you linked, it appears WinRAR doesn't delete these temporary files if you close WinRAR while you have them open in certain other programs like Word. This sort of order dependence is an accident waiting to happen, so I would still recommend migrating to a dedicated password manager program. Again, I like KeePass because it can be used solely with local storage on my Windows, iOS, and Android devices, and I've been using it for 20 years without ever having any desire to switch.

AlwaysCranky · Mar 15, 2024

I wanted to make sure to register on this site just so I could post a comment that says... Another instance of Microsoft improving things without thinking through how it actually doesn't improve things. Like my missing window edges, and inability to Cascade Windows, and the removal of the simple Save As dialog, and the disappearance of traditional control panels, and... Well, those come to mind off the top of my head.

"I know that this is an old thread, but I want to reply to it anyway."

Almighty1 · Jul 14, 2024

memo09 said:
Update: I found the location by asking ChatGPT. I checked and the information is legit.
C:\Users\<YourUsername>\AppData\Local\Packages\Microsoft.Windows.Notepad_8wekyb3d8bbwe\LocalState\TabState
In the above directory (insert your own username) a .binfile is created, which contain the plain text of the autosave file.
You can delete the contents of this directory. I hope some other users find information useful.
Update2: I detected that the bin-file in the TabState directory will be automatically deleted by the app if you select the Notepad setting to "When notepad starts do open a new window" instead of "open the previous session". So the developers had some sense of security in mind.

View attachment 74651

Many thanks for this as well, I accidentally closed a temp tab that I did not save and forgot if anything I had in it was important. With what you mentioned, I was able to look at the contents of deleted files that were created with Windows Volume Shadow Copy Service before I found it. I noticed some of the files are not text but binary and even with the text, it seems to be plain text in a binary file as there is lots of spacing added between each text character and the line feeds are missing.