Standard Notes stores notes, tags and preferences in a workspace that can synchronize through an account or remain only on one device. Account clients encrypt and authenticate changes before sending them to the server. A no-account workspace does not synchronize, and Standard Notes does not encrypt that local-only data until the user configures an Application Passcode.
Editors write different note representations
A note type determines the representation stored inside a note. Plain text, Markdown, tasks, spreadsheets, code and authenticator data use compatible editors for their structure. Switching a formatted note to Plain Editor does not erase the formatting source. It exposes the code that the former editor inserted.
Several structured editors derive from third-party projects. A bug or missing function in one of those editing engines may depend on its upstream maker rather than the Standard Notes synchronization layer. Changing editors can alter how the same stored content appears, so a test copy is safer than assuming every editor can round-trip every element.
Account encryption and device access are separate
The account password derives a root key, and random items keys encrypt synchronized notes, tags and preferences. The server receives encrypted item data rather than note text. An Application Passcode adds a device-specific secret that wraps local keys. Its derived keys do not remain stored on disk.
Without an account and without a passcode, local value and payload storage remain unencrypted. In a web browser, an account session without a passcode can also leave account keys plainly in browser application storage because the browser lacks a protected system keychain. Biometric access adds an interface barrier; it does not change the cryptographic state of the database on disk.
The Stay signed in choice affects persistence. When the user leaves it unchecked, Standard Notes keeps the working data in temporary memory and wipes local application data after the app or browser closes. Offline account edits can continue against previously synchronized notes, but they reach the server only after connectivity returns and Standard Notes opens again.
Encrypted and decrypted backups expose different risks
An encrypted backup requires the account password for restoration or decryption. The official offline tool can decrypt it in a browser. A decrypted backup zip contains readable note files, so it no longer has the protection of the account encryption. The desktop application creates automatic encrypted text backups only while it is running.
If the account password is lost while one client remains signed in, the user can export decrypted notes and move them into a new account. Files follow a separate path: ordinary note import does not restore the attached-file collection, and those files need another upload. The signed-in client therefore gives a migration opportunity, not a way to recover the forgotten account secret.
