siyuan-note/siyuan · error

Encrypted notebook feature is not enabled

Error message

Encrypted notebook feature is not enabled

What it means

Returned by CreateEncryptedBox when Conf.NotebookCrypto.Enabled is false or notebookCryptoConfigurationComplete returns false. You cannot create an encrypted notebook until the global encryption feature is enabled and fully configured (master password set, KDF parameters chosen). The message comes from Conf.Language(310): 'Encrypted notebook feature is not enabled'.

Source

Thrown at kernel/model/crypto.go:2543

			return err
		}
		return nil
	}
	return filelock.Copy(srcPath, destPath)
}

// CreateEncryptedBox 创建一个新的加密笔记本。可多次调用创建多个。
// 前置：加密功能已启用。创建时需要主密码（临时派生 KEK 用于 wrap DEK，用完即弃）。
// 创建后直接用生成的 DEK 打开加密 db 并缓存（已解锁状态），调用方随后调 openNotebook 即可挂载。
func CreateEncryptedBox(name, password string) (id string, err error) {
	notebookCryptoMu.Lock()
	defer notebookCryptoMu.Unlock()

	Conf.m.RLock()
	notebookCrypto := *Conf.NotebookCrypto
	Conf.m.RUnlock()
	if !notebookCrypto.Enabled || !notebookCryptoConfigurationComplete(&notebookCrypto) {
		return "", errors.New(Conf.Language(310))
	}

	kek, err := deriveKEK(password)
	if err != nil {
		return "", err
	}
	defer zeroAndClear(kek)

	id, err = createBox(name, false)
	if err != nil {
		return "", err
	}
	setEncryptedBoxState(id, EncryptedBoxStateUnlocking)

	// 若后续步骤失败，清理已创建的 box 目录和加密 db 文件，避免半创建状态
	createdBoxID := id
	defer func() {
		if err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Guide the user through enabling encryption first: set a master password and KDF parameters via the encryption settings UI/API.
2. Check notebookCryptoConfigurationComplete output to identify which specific config field is missing.
3. Ensure Conf.NotebookCrypto is loaded from disk (Conf is not nil and properly initialized) before calling CreateEncryptedBox.

// Check encryption feature state before creating an encrypted box
Conf.m.RLock()
nc := *Conf.NotebookCrypto
Conf.m.RUnlock()
if !nc.Enabled || !notebookCryptoConfigurationComplete(&nc) {
    return errors.New("enable encryption in settings first")
}

When it happens

Trigger: CreateEncryptedBox is called via the API/UI before the user has enabled notebook encryption in settings. Also fires if the configuration is partially set (e.g., enabled flag is true but required KDF fields are missing).

Common situations: User clicks 'create encrypted notebook' without first going through the encryption-setup flow. Config file was manually edited, leaving Enabled=true but missing KDF parameters. Fresh install where setup wizard wasn't completed.

Related errors

• encrypt notebook metadata failed: %w
• save encrypted notebook conf failed: %w
• write notebook crypt backup failed: %w
• encrypted notebook metadata verification failed after write
• initialize encrypted notebook document failed: %w

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/0b554239370af0bc. Report an issue: GitHub.