Standard Notes 2FA: how to set up an authenticator app

Your Standard Notes account holds the encrypted notes, tags and files you sync between devices. Two-factor authentication (2FA) is optional and free on every plan. It used to be a paid extra, until Standard Notes opened it to all users in March 2022 (Standard Notes). The one thing to plan for is the secret key you get during setup. Standard Notes' help doesn't mention backup codes, so that key is what gets you back in if your phone goes missing. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Standard Notes steps come from Standard Notes' own help pages and blog, linked below, which we read on October 21, 2026. We haven't tested them on a Standard Notes account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

Standard Notes' help gives four short steps (Standard Notes):

1. In the Standard Notes app, select the profile icon in the bottom left corner, then Account settings.
2. Select Security on the left.
3. Turn on the Two-factor authentication toggle.
4. Scan the QR code with your authenticator, or copy the code shown next to it and paste it in.

In Novaz, tap +, then Scan QR code, and point the camera at the code. If Standard Notes is open on the same iPhone, take a screenshot first and use Choose a photo instead. See scanning a QR code on the same iPhone.

The code you can copy is what Standard Notes' other help pages call your 2FA secret key. To type it into Novaz, tap +, then Enter key manually, put "Standard Notes" in Service, your email in Account if you like, and paste the key into Setup key. More in What is a 2FA setup key?

The help page ends at the scan step. It doesn't say whether the app then asks you for a code to confirm, so follow what's on your screen.

Save the secret key before you finish

Copy the secret key somewhere outside your phone while it's still on screen. Standard Notes says the key has to be kept safe in case you lose the device you set 2FA up on (Standard Notes). Its suggestions:

• a password manager,
• a sheet of paper kept somewhere safe,
• a note in Standard Notes itself, followed straight away by a download of an encrypted backup of your data, kept somewhere safe.

The third needs care: a note inside the account is no use when you need the key to sign in, which Standard Notes admits makes it "tricky". The encrypted backup is the real copy, since you can decrypt it and read the key. The same goes for Standard Notes' own Authenticator feature, which stores 2FA secrets for other services (Standard Notes): don't rely on it for the Standard Notes key itself.

Keep the saved key even if you back up Novaz: without iCloud backup or a backup file, Novaz's copy exists only on your iPhone. See 2FA backup codes.

When Standard Notes asks for a code

You enter a code when you sign in to your account (Standard Notes). The help pages don't say whether devices that are already signed in ask again.

One quirk: Standard Notes sometimes shows a decoy 2FA prompt, so outsiders can't use the prompt to test whether an email address has an account. If you're asked for a code and you never set up 2FA, check your email address for a typo, or write to help@standardnotes.com from your account email (Standard Notes).

If Standard Notes rejects your code

Standard Notes' help doesn't cover rejected codes. First make sure the account really has 2FA on, given the decoy prompt above. Then check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones or losing your authenticator

If you saved the secret key, Standard Notes' advice is simply to import it into your authenticator app again (Standard Notes). In Novaz on the new iPhone, use Enter key manually with the same key. The key stays the same, so you don't need to change anything in your account. If you have a Novaz iCloud backup or backup file, you can restore all your accounts on the new iPhone instead of adding them one by one. See How to transfer your authenticator app to a new iPhone.

Standard Notes' page also mentions turning the key into a QR code with an online tool. Novaz takes the key directly, and it's safer not to paste it into a website.

If you lost both the phone and the key, email help@standardnotes.com from the email address on your account and ask them to turn off two-factor authentication. Standard Notes doesn't say what else it asks for or how long it takes. More in Lost the phone with your authenticator app?

Keep your password safe too. Standard Notes can't reset it, because of its encryption. Without the password, the only option is to delete the account and start again (Standard Notes).

Hardware security keys

With a Professional subscription you can also add a hardware key, such as a YubiKey, under Hardware Security Key Authentication on the Security tab. That page tells you to save your account recovery key in case you lose the hardware key (Standard Notes). The authenticator app pages don't mention a recovery key.

Official Standard Notes help

• How do I enable two-factor authentication for my account?
• Where should I store my two-factor authentication secret key?
• What happens if I lose my 2FA device and my secret key?
• Why am I asked for 2FA, even though I don't have it enabled?
• How do I protect my account with a hardware security key?
• I've forgotten my password. What should I do?
• Two-factor authentication for all
• Features