Pentest notes that actually match how you work
Obsidian wasn't built for engagements. Notion wasn't built for network diagrams. CherryTree wasn't built for either. PentNotes gives every engagement a ready-made structure, a real infrastructure canvas, and a host inventory that stays in sync — automatically.
You've tried the others
Every pentester has a note-taking setup cobbled together from tools built for something else entirely. Each one gets you most of the way there.
Heavy for structured technical work, with no real canvas to map a network — and since your notes aren't stored as plain markdown, they're not portable the way a text-based vault is.
Marketed as portable, but real portability means paying for Sync, wiring up Git yourself, or juggling plugins — there's no simple way to just pick up and go.
Your notes live in a single file on a single machine, with no canvas — nothing to visualize a network with, and nothing to hand off if that laptop dies.
How PentNotes compares
Every tool here is good at something. PentNotes is the only one built specifically for running a pentest engagement, start to finish.
| Feature | PentNotes | Obsidian | Notion | CherryTree |
|---|---|---|---|---|
Ready-made engagement structure Recon, enumeration, exploitation, and evidence folders on day one — no templates to set up. | ||||
Purpose-built network canvas Typed components — servers, firewalls, routers, domain controllers — not generic shapes. | ||||
Structured host & port inventory IP, hostname, and per-port service/version tracking, kept in sync with the canvas. | ||||
Modern, cross-platform workspace Runs in any browser — no desktop install, no plugin hunting. | ||||
AI-assisted report drafting Turn engagement notes into a first-draft report. | Soon |
Everything an engagement needs
Not a generic notes app with pentest templates bolted on — built around how an engagement actually moves.
Zero-setup engagement structure
Recon, enumeration, vulnerabilities, exploitation, post-exploitation, evidence — generated the moment you create an engagement.
A canvas built for infrastructure
Typed components for servers, firewalls, routers, and more. Draw connections, then style each one — color, dash pattern, label, direction.
Hosts that stay in sync
Add a host on the canvas or in the table and it shows up in both. Structured IP, hostname, and per-port service/version fields — not another wall of text.
Private to your account
Every engagement is isolated to your account, enforced at the database level — sign in from any device to pick up exactly where you left off.
Markdown that feels like an IDE
Split-pane editor and preview, syntax highlighting, and code blocks built for pasting commands and output.
AI report drafting
Turn a finished engagement's notes into a first-draft report.
From kickoff to report in three steps
Create an engagement
Pick a type — External Pentest, HTB, TryHackMe, Red Team — and get a full folder structure instantly, ready to fill in.
Map the target
Drop servers, firewalls, and routers onto the canvas and connect them. Every host you add shows up in the table too.
Write as you go
Structured notes per phase, drag-and-drop evidence, and findings that are ready to hand off the moment you're done.