Standard Notes Review: The Logic of Encrypted Persistence and the Data-Decay Unhack

You opened a notes app at midnight and typed the thing you’d tell no one — the salary you’re chasing, the diagnosis you’re scared of, the plan you haven’t said out loud. It felt private. It wasn’t. On Apple Notes, Google Keep, or Notion, that note sits unencrypted on a company’s servers right now, readable by their engineers, their legal team, their AI training pipeline, and any government with a warrant you’ll never hear about.

The short version: Standard Notes is an encrypted note app that scrambles your data on your own device — with AES-256 or XChaCha20 — before it ever syncs, so the company operates a zero-knowledge server that literally cannot read your notes, titles, or tags. It costs around $99/year for the full feature set, runs across every platform, supports self-hosting on Umbrel or Docker, and syncs about as fast as the unencrypted apps. The one real cost: lose your password and your notes are gone forever, because there is no one on the other end who can reset it.

Why standard cloud notes are a privacy hack

Here’s the game, laid out plainly. You type a note. It travels — often unencrypted at rest — to the company’s server. Engineers can read it. Compliance teams can read it. Models trained on user data can ingest it. Law enforcement can subpoena it without telling you. Your private thought has quietly become a data product, and you funded the warehouse it’s stored in.

The vendors have a tidy excuse: “We need to read your notes to index them for fast search.” That’s the part to stop believing.

Here’s the thing they’re counting on you never asking: client-side encryption with local indexing gives you fast search without the company ever seeing a word. Which means readability was never a technical requirement — the real reason your notes stay legible is that it pays them, not you. They keep your thoughts open because behavioural profiling is worth more than your subscription, because subpoenaing plaintext avoids legal friction, and because training AI on your content is free labour.

Standard Notes breaks that model at the root. You hold the key. The company runs a sync server that stores encrypted blobs it cannot open, even if it wanted to.

How Standard Notes’ encryption architecture works

The whole innovation is one move: shift encryption off the server and onto your device. Once you see the flow, the rest follows.

1. You write a note on your device — phone, laptop, or browser.
2. The Standard Notes client encrypts it locally, using AES-256 or XChaCha20, before it leaves your hands.
3. The encrypted blob syncs to Standard Notes’ server alongside your account details.
4. The server stores that encrypted data and never holds the key.
5. On another device, the client downloads the blob and decrypts it locally with your password.

Your root password is hashed with Argon2 — a deliberately slow algorithm built to resist brute-force incidents. So even if someone stole the entire Standard Notes database, the notes inside would be mathematically useless without your password.

The quiet breakthrough: your notes stay searchable and sync in real time, yet the company has zero visibility into their content. Not even your titles and tags are readable to the server — they’re encrypted too.

What Standard Notes actually cannot see: the zero-knowledge line

“Zero-knowledge” gets thrown around loosely, so here is the exact line. The company cannot see your note content, your note titles, your tags and folders, your edit timestamps, or even how many notes you have — the server sees blobs, not a count.

It can see your email address, your account creation date, the fact that a sync happened (not its content), and which extensions you’ve enabled.

That boundary is the entire difference. Compare it to Notion: data is encrypted in transit over HTTPS, then decrypted on arrival. Your Notion workspace is legible to their engineering team, their legal team, their AI training pipeline, and any government with a warrant. The padlock in your browser bar protects the journey, not the destination — and most people never learn the difference until it matters.

Standard Notes vs. the alternatives: the honest comparison

No tool is free of trade-offs, and pretending otherwise is its own kind of dishonesty. Here’s where Standard Notes sits against the field.

| Feature | Standard Notes | Apple Notes | Google Keep | Notion | Obsidian | |—|—|—|—|—|—| | End-to-end encryption | Yes (AES-256) | Optional (iCloud+) | No | No | Yes (local only) | | Company can read your notes | No | Yes (default) | Yes | Yes | No | | Self-hosting option | Yes (Umbrel, Docker) | No | No | No | No | | Cost for full features | $99/year | Free (limited) | Free | $120/year | $40 (one-time) | | Works offline | Yes | Yes | Limited | Limited | Yes | | Cross-platform | Yes | Apple only | Google ecosystem | Yes | Yes |

The honest trade-off: Standard Notes costs money and ships fewer “AI features” precisely because it cannot train models on your data. It’s slower to add new editors, because each one has to be rebuilt to preserve end-to-end encryption. Notion is faster and cheaper because your data funds its operations. Obsidian is encrypted by being local-only, which is excellent until you need reliable sync across devices. You’re choosing what you’d rather pay with — money, or readability.

How to set up Standard Notes: the operational reality

Unlike Notion’s install-and-go, Standard Notes asks for a little deliberate setup. The good news: the most important step takes two minutes, and it’s the one that protects everything else.

• Generate a strong password — and write it down physically. Your password is your encryption key. Use a password manager to make 20+ random characters, then store a copy somewhere offline. If you lose it, your notes are unrecoverable: there’s no “forgot password” reset, because the company genuinely cannot decrypt them without it.
• Enable two-factor authentication. A thief with your password still can’t get in without your 2FA device. Standard Notes supports authenticator apps and hardware keys like YubiKey.
• Subscribe to open the full editor set. The free plan covers basic notes. The $99/year Professional plan adds Markdown, spreadsheets, a code editor, and advanced search; the $179/year Plus plan adds collaborative notes and advanced sync.
• Configure independent backups. Export your notes as encrypted JSON — readable only with your password — and keep copies on an external drive or private storage like Proton Drive.
• Optional: self-host. If you’d rather not trust the company’s servers at all, run your own sync server on Umbrel or Docker. The third party disappears entirely; you control the hardware.

Is encrypted note-taking actually fast? The performance trade-off

Encryption adds overhead, so the fair question is whether you’ll feel it. Mostly, no.

Syncing takes a second or two longer than unencrypted apps on first load. Search runs 50–100ms slower because it happens locally, on your device, rather than on the server’s pre-indexed database. On any device from the last few years, that’s imperceptible. On an old phone or weak WiFi, you’ll notice it.

The whole bargain is roughly a tenth of a second against your private thoughts being a data product. Most people, once they see it stated that way, stop hesitating.

Who actually needs this? The risk signal model

Standard Notes earns its keep the moment you store anything you wouldn’t hand to a stranger: financial or tax-planning documents, legal notes or attorney drafts, health and mental-health notes, business strategy or competitive intelligence, or simply private reflections you’d never post.

If you only keep recipe ideas and holiday plans, unencrypted notes are genuinely fine — there’s no need to pay $99/year to protect a shopping list. The verdict is honest both ways: for sensitive work it’s close to non-negotiable; for trivia it’s overkill. Most knowledge workers fall on the first side without realising it.

The reason people miss it is that they imagine their notes app as a private drawer, when it’s closer to a filing cabinet in a building owned by someone who reads the files to sell what’s in them. You don’t have to be doing anything secretive to want a drawer that’s actually yours. The lawyer drafting a sensitive argument, the founder sketching a strategy a competitor would pay for, the person quietly working through a diagnosis at midnight — none of them are paranoid. They’ve just understood that “I have nothing to hide” was always the wrong frame. The right frame is “this is mine, and the default arrangement gives it away.”

What could go wrong — and what stays safe

The failure modes matter, because a tool you don’t understand is a tool you’ll abandon at the first scare. Here are the real ones.

• You forget your password. Your notes are permanently unrecoverable; the company cannot reset it. Store the password somewhere physical that survives losing your devices.
• The service shuts down. Your encrypted notes still live in your backups, and you can import them into Obsidian, Joplin, or another app because Standard Notes exports valid encrypted JSON. You are not locked in.
• A major encryption flaw is found. Unlikely — AES-256 has been studied for 25+ years — but if it happened you’d migrate to a new system, and the team publishes audits and patches disclosed issues quickly.
• You’re targeted by a state actor. Encryption protects the data, not the metadata. A subpoena reveals when you last synced and from which IP, but not the notes’ content. Physical seizure of a powered-on device is the genuine edge case — that’s a determined adversary problem, not a mass-surveillance one, and it’s the honest limit of what any encrypted app can promise.

Frequently asked questions

Can Standard Notes see my notes?
No. Encryption happens on your device before anything leaves it. Standard Notes runs a zero-knowledge server — it literally cannot decrypt your notes without your password, and it doesn’t have your password.

What if I want to share a note?
Standard Notes includes a Shared Notes feature on paid plans. You generate a link for one specific note; people with the link see only that note, not your other data, and you can set passwords and expiry dates on the link.

Is Markdown supported?
Yes. The Markdown editor (part of the Professional plan) renders formatted text, code blocks, and tables, and you can export notes as Markdown files readable by Obsidian, Joplin, or any text editor.

How do I know it’s actually encrypted?
Standard Notes is open-source — the client code is publicly auditable on GitHub, so you can read it yourself or rely on the third-party security audits (the most recent published in 2023) that confirm the encryption implementation.

The bottom line

You came here because something you typed at midnight should never have been readable, and now you know that on most apps it is. That instinct was correct. The padlock you trusted protected the journey, not the destination.

Standard Notes closes the gap. It costs around $99/year, syncs across every device, and makes it mathematically impossible for the company — or anyone else — to read what you write. In return it asks you to remember one password and keep your own backups, which is a fair trade for owning your own mind on paper.

The vendors selling unencrypted notes were always counting on you not thinking about who reads them. You’re thinking about it now — and that’s the whole shift, from being the product to being the owner of the one place you’re supposed to be able to be honest. Pick the password. Write it down. You hold the key now, and no one on the other end can take it.