diff --git a/src/middleware/rateLimit.js b/src/middleware/rateLimit.js
new file mode 100644
index 0000000..ab3343f
--- /dev/null
+++ b/src/middleware/rateLimit.js
@@ -0,0 +1,18 @@
+// Fixed-window rate limiter keyed by an arbitrary string.
+
+export function createRateLimiter({ limit, windowMs, now = Date.now }) {
+  const counts = new Map();
+  let currentWindow = null;
+
+  return function allow(key) {
+    const windowStart = Math.floor(now() / windowMs) * windowMs;
+    if (windowStart !== currentWindow) {
+      counts.clear();
+      currentWindow = windowStart;
+    }
+    const count = counts.get(key) ?? 0;
+    if (count >= limit) return false;
+    counts.set(key, count + 1);
+    return true;
+  };
+}
diff --git a/src/routes/notes.js b/src/routes/notes.js
index 8248dc1..327a174 100644
--- a/src/routes/notes.js
+++ b/src/routes/notes.js
@@ -1,8 +1,24 @@
 import { createNote, deleteNote, getNote, listNotes, updateNote } from '../services/notes.js';
 import { noteSummary } from '../utils/format.js';
 
+const DEFAULT_PAGE_SIZE = 5;
+const MAX_PAGE_SIZE = 50;
+
+function positiveInt(value, fallback) {
+  const n = Number.parseInt(value, 10);
+  return Number.isFinite(n) && n >= 1 ? n : fallback;
+}
+
+function listPage(req) {
+  const page = positiveInt(req.query?.page, 1);
+  const pageSize = Math.min(positiveInt(req.query?.pageSize, DEFAULT_PAGE_SIZE), MAX_PAGE_SIZE);
+  const notes = listNotes(req.user.id);
+  const start = (page - 1) * pageSize;
+  return { items: notes.slice(start, start + pageSize).map(noteSummary), page, pageSize, total: notes.length };
+}
+
 export const notesRoutes = {
-  'GET /notes': (req) => ({ status: 200, body: listNotes(req.user.id).map(noteSummary) }),
+  'GET /notes': (req) => ({ status: 200, body: listPage(req) }),
   'GET /notes/:id': (req) => {
     const note = getNote(req.user.id, req.params.id);
     return note ? { status: 200, body: note } : { status: 404, body: { error: 'not found' } };
diff --git a/src/utils/format.js b/src/utils/format.js
index 24a3a09..4c90f41 100644
--- a/src/utils/format.js
+++ b/src/utils/format.js
@@ -3,7 +3,7 @@
 // Dates are shown as YYYY-MM-DD in UTC.
 export function formatDate(ms) {
   const d = new Date(ms);
-  const month = String(d.getUTCMonth()).padStart(2, '0');
+  const month = String(d.getUTCMonth() + 1).padStart(2, '0');
   const day = String(d.getUTCDate()).padStart(2, '0');
   return `${d.getUTCFullYear()}-${month}-${day}`;
 }
diff --git a/tests/api.test.js b/tests/api.test.js
index 32d499e..1db7db4 100644
--- a/tests/api.test.js
+++ b/tests/api.test.js
@@ -15,11 +15,32 @@ test('notes need a valid token', () => {
   assert.equal(handle({ method: 'GET', path: '/notes', headers: {} }).status, 401);
 });
 
-test('lists only my notes, newest first', () => {
+test('lists only my notes, newest first, paginated', () => {
   const res = as('u1', { method: 'GET', path: '/notes' });
   assert.equal(res.status, 200);
-  assert.equal(res.body.length, 8);
-  assert.equal(res.body[0].title, 'Car service');
+  assert.equal(res.body.total, 8);
+  assert.equal(res.body.page, 1);
+  assert.equal(res.body.pageSize, 5);
+  assert.equal(res.body.items.length, 5);
+  assert.equal(res.body.items[0].title, 'Car service');
+});
+
+test('pagination returns later pages and a short last page', () => {
+  const res = as('u1', { method: 'GET', path: '/notes', query: { page: '2' } });
+  assert.equal(res.body.page, 2);
+  assert.equal(res.body.items.length, 3);
+  assert.equal(res.body.total, 8);
+  const beyond = as('u1', { method: 'GET', path: '/notes', query: { page: '9' } });
+  assert.deepEqual(beyond.body.items, []);
+});
+
+test('pageSize is honoured, capped at 50, and bad values fall back', () => {
+  const small = as('u1', { method: 'GET', path: '/notes', query: { pageSize: '2' } });
+  assert.equal(small.body.items.length, 2);
+  assert.equal(as('u1', { method: 'GET', path: '/notes', query: { pageSize: '500' } }).body.pageSize, 50);
+  const bad = as('u1', { method: 'GET', path: '/notes', query: { page: '-1', pageSize: 'abc' } });
+  assert.equal(bad.body.page, 1);
+  assert.equal(bad.body.pageSize, 5);
 });
 
 test('creates and deletes a note', () => {
diff --git a/tests/format.test.js b/tests/format.test.js
new file mode 100644
index 0000000..e255dec
--- /dev/null
+++ b/tests/format.test.js
@@ -0,0 +1,9 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { formatDate } from '../src/utils/format.js';
+
+test('formatDate uses 1-based months', () => {
+  assert.equal(formatDate(Date.UTC(2026, 2, 15)), '2026-03-15');
+  assert.equal(formatDate(Date.UTC(2026, 0, 1)), '2026-01-01');
+  assert.equal(formatDate(Date.UTC(2026, 11, 31)), '2026-12-31');
+});
diff --git a/tests/rateLimit.test.js b/tests/rateLimit.test.js
new file mode 100644
index 0000000..e8f66a8
--- /dev/null
+++ b/tests/rateLimit.test.js
@@ -0,0 +1,42 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRateLimiter } from '../src/middleware/rateLimit.js';
+
+test('allows up to limit calls per key, then blocks', () => {
+  const allow = createRateLimiter({ limit: 2, windowMs: 1000, now: () => 5000 });
+  assert.equal(allow('a'), true);
+  assert.equal(allow('a'), true);
+  assert.equal(allow('a'), false);
+  assert.equal(allow('a'), false);
+});
+
+test('keys are counted independently', () => {
+  const allow = createRateLimiter({ limit: 1, windowMs: 1000, now: () => 0 });
+  assert.equal(allow('a'), true);
+  assert.equal(allow('b'), true);
+  assert.equal(allow('a'), false);
+});
+
+test('windows are fixed at multiples of windowMs', () => {
+  let t = 1000;
+  const allow = createRateLimiter({ limit: 1, windowMs: 1000, now: () => t });
+  assert.equal(allow('a'), true);
+  t = 1999;
+  assert.equal(allow('a'), false);
+  t = 2000;
+  assert.equal(allow('a'), true);
+  assert.equal(allow('a'), false);
+});
+
+test('late call in a window does not extend it', () => {
+  let t = 900;
+  const allow = createRateLimiter({ limit: 1, windowMs: 1000, now: () => t });
+  assert.equal(allow('a'), true);
+  t = 1000;
+  assert.equal(allow('a'), true);
+});
+
+test('limit 0 blocks everything', () => {
+  const allow = createRateLimiter({ limit: 0, windowMs: 1000, now: () => 0 });
+  assert.equal(allow('a'), false);
+});