Both. See the link. Notes on a site/password go in the "extra" field, which is encrypted. For most people it looks like the only field that should hold any u

Both. See the link. Notes on a site/password go in the "extra" field, which is encrypted. For most people it looks like the only field that should hold any user-provided unencrypted data is the URL field.