diff --git a/src/becca/entities/bnote.js b/src/becca/entities/bnote.js
index 7dc0cb92f..2e00b7824 100644
--- a/src/becca/entities/bnote.js
+++ b/src/becca/entities/bnote.js
@@ -1106,16 +1106,19 @@ class BNote extends AbstractBeccaEntity {
         return minDistance;
     }
 
+    /** @returns {BNoteRevision[]} */
     getNoteRevisions() {
         return sql.getRows("SELECT * FROM note_revisions WHERE noteId = ?", [this.noteId])
             .map(row => new BNoteRevision(row));
     }
 
+    /** @returns {BNoteAttachment[]} */
     getNoteAttachments() {
         return sql.getRows("SELECT * FROM note_attachments WHERE noteId = ? AND isDeleted = 0", [this.noteId])
             .map(row => new BNoteAttachment(row));
     }
 
+    /** @returns {BNoteAttachment|undefined} */
     getNoteAttachmentByName(name) {
         return sql.getRows("SELECT * FROM note_attachments WHERE noteId = ? AND name = ? AND isDeleted = 0", [this.noteId, name])
             .map(row => new BNoteAttachment(row))
@@ -1442,6 +1445,7 @@ class BNote extends AbstractBeccaEntity {
         this.getNoteAttachments()
 
         const noteAttachment = new BNoteAttachment({
+            noteId: this.noteId,
             name,
             mime,
             isProtected: this.isProtected
diff --git a/src/becca/entities/bnote_attachment.js b/src/becca/entities/bnote_attachment.js
index b60476d29..e48707da0 100644
--- a/src/becca/entities/bnote_attachment.js
+++ b/src/becca/entities/bnote_attachment.js
@@ -125,12 +125,12 @@ class BNoteAttachment extends AbstractBeccaEntity {
         return {
             noteAttachmentId: this.noteAttachmentId,
             noteId: this.noteId,
-            mime: this.mime,
-            isProtected: this.isProtected,
             name: this.name,
+            mime: this.mime,
+            isProtected: !!this.isProtected,
+            isDeleted: false,
             utcDateModified: this.utcDateModified,
             content: this.content,
-            contentLength: this.contentLength
         };
     }
 
diff --git a/src/public/app/components/root_command_executor.js b/src/public/app/components/root_command_executor.js
index 917f45af4..63b810d54 100644
--- a/src/public/app/components/root_command_executor.js
+++ b/src/public/app/components/root_command_executor.js
@@ -88,8 +88,12 @@ export default class RootCommandExecutor extends Component {
         await this.showAndHoistSubtree('_hidden');
     }
 
-    async showOptionsCommand() {
-        await this.showAndHoistSubtree('_options');
+    async showOptionsCommand({section}) {
+        await appContext.tabManager.openContextWithNote(
+            section || '_options',
+            true,
+            null,
+            '_options');
     }
 
     async showSQLConsoleHistoryCommand() {
diff --git a/src/public/app/widgets/dialogs/password_not_set.js b/src/public/app/widgets/dialogs/password_not_set.js
index a1fc40044..011cc51d4 100644
--- a/src/public/app/widgets/dialogs/password_not_set.js
+++ b/src/public/app/widgets/dialogs/password_not_set.js
@@ -28,7 +28,7 @@ export default class PasswordNoteSetDialog extends BasicWidget {
         this.$widget = $(TPL);
         this.$openPasswordOptionsButton = this.$widget.find(".open-password-options-button");
         this.$openPasswordOptionsButton.on("click", () => {
-            this.triggerCommand("showOptions", { openTab: 'PasswordOptions' });
+            this.triggerCommand("showOptions", { section: '_optionsPassword' });
         });
     }
 
diff --git a/src/public/app/widgets/dialogs/recent_changes.js b/src/public/app/widgets/dialogs/recent_changes.js
index f0e82a7cc..4a7158180 100644
--- a/src/public/app/widgets/dialogs/recent_changes.js
+++ b/src/public/app/widgets/dialogs/recent_changes.js
@@ -8,6 +8,7 @@ import hoistedNoteService from "../../services/hoisted_note.js";
 import BasicWidget from "../basic_widget.js";
 import dialogService from "../../services/dialog.js";
 import toastService from "../../services/toast.js";
+import ws from "../../services/ws.js";
 
 const TPL = `
 <div class="recent-changes-dialog modal fade mx-auto" tabindex="-1" role="dialog">
@@ -94,9 +95,9 @@ export default class RecentChangesDialog extends BasicWidget {
 
                                     this.$widget.modal('hide');
 
-                                    await froca.reloadNotes([change.noteId]);
-
-                                    appContext.tabManager.getActiveContext().setNote(change.noteId);
+                                    setTimeout(() => {
+                                        appContext.tabManager.getActiveContext().setNote(change.noteId);
+                                    }, 1000);
                                 }
                             });
 
diff --git a/src/services/note_attachments.js b/src/services/note_attachments.js
new file mode 100644
index 000000000..781e89281
--- /dev/null
+++ b/src/services/note_attachments.js
@@ -0,0 +1,37 @@
+const protectedSession = require("./protected_session.js");
+const log = require("./log.js");
+
+/**
+ * @param {BNote} note
+ */
+function protectNoteAttachments(note) {
+    for (const noteAttachment of note.getNoteAttachments()) {
+        if (note.isProtected !== noteAttachment.isProtected) {
+            if (!protectedSession.isProtectedSessionAvailable()) {
+                log.error("Protected session is not available to fix note attachments.");
+
+                return;
+            }
+
+            try {
+                const content = noteAttachment.getContent();
+
+                noteAttachment.isProtected = note.isProtected;
+
+                // this will force de/encryption
+                noteAttachment.setContent(content);
+
+                noteAttachment.save();
+            }
+            catch (e) {
+                log.error(`Could not un/protect note attachment ID = ${noteAttachment.noteAttachmentId}`);
+
+                throw e;
+            }
+        }
+    }
+}
+
+module.exports = {
+    protectNoteAttachments
+}
diff --git a/src/services/notes.js b/src/services/notes.js
index 37d09c33e..1e8d658e9 100644
--- a/src/services/notes.js
+++ b/src/services/notes.js
@@ -9,6 +9,7 @@ const protectedSessionService = require('../services/protected_session');
 const log = require('../services/log');
 const utils = require('../services/utils');
 const noteRevisionService = require('../services/note_revisions');
+const noteAttachmentService = require('../services/note_attachments');
 const attributeService = require('../services/attributes');
 const request = require('./request');
 const path = require('path');
@@ -17,11 +18,11 @@ const becca = require('../becca/becca');
 const BBranch = require('../becca/entities/bbranch');
 const BNote = require('../becca/entities/bnote');
 const BAttribute = require('../becca/entities/battribute');
+const BNoteAttachment = require("../becca/entities/bnote_attachment");
 const dayjs = require("dayjs");
 const htmlSanitizer = require("./html_sanitizer");
 const ValidationError = require("../errors/validation_error");
 const noteTypesService = require("./note_types");
-const BNoteAttachment = require("../becca/entities/bnote_attachment.js");
 
 function getNewNotePosition(parentNoteId) {
     const note = becca.notes[parentNoteId];
@@ -300,6 +301,7 @@ function protectNote(note, protect) {
         }
 
         noteRevisionService.protectNoteRevisions(note);
+        noteAttachmentService.protectNoteAttachments(note);
     }
     catch (e) {
         log.error(`Could not un/protect note ID = ${note.noteId}`);
diff --git a/src/services/protected_session.js b/src/services/protected_session.js
index c6098cc2f..095030d93 100644
--- a/src/services/protected_session.js
+++ b/src/services/protected_session.js
@@ -2,7 +2,6 @@
 
 const log = require('./log');
 const dataEncryptionService = require('./data_encryption');
-const options = require("./options");
 
 let dataKey = null;
 
@@ -64,6 +63,7 @@ function touchProtectedSession() {
 }
 
 function checkProtectedSessionExpiration() {
+    const options = require("./options");
     const protectedSessionTimeout = options.getOptionInt('protectedSessionTimeout');
     if (isProtectedSessionAvailable()
         && lastProtectedSessionOperationDate