See the link.

Notes on a site/password go in the "extra" field, which is encrypted.

For most people it looks like the only field that should hold any user-provided unencrypted data is the URL field.