Make a small, safe start.

1. Open the sample demo on the home page. Reveal an invented login, generate a sample password, open the test card and lock the demo.
2. For your own vault, choose a unique master passphrase of at least 12 characters. Prefer a long randomly generated phrase; do not reuse an account password. Save a recovery plan somewhere safe before relying on the vault.
3. Create an invented login first. Lock and unlock to confirm the passphrase works.
4. Use Export backup. Keep the encrypted KDBX somewhere you control, separate from the only device that can open it.
5. Test restoring a copy in a separate browser profile. Import replaces that profile’s stored vault after successful decryption; back up any existing copy first.

In Settings, choose an idle lock of 1, 5 or 15 minutes. Hidden pages lock immediately. Native pairing uses a separate approval flow. Preview installers have platform-specific limitations on the download page.

Passwords and verification codes

In Add → Login, open Password options to choose length and character groups. Press Generate, then Save encrypted item. Generating here does not change your password on the website itself.

Open Add a verification code to enter a supported Base32 setup key or otpauth address from the service you are securing. Save, then reveal or copy the rotating code. QR scanning is not included yet. Keep the device clock automatic and retain the service’s recovery codes separately. Passwords and authenticators stored in the same vault share the risk of that vault being compromised.

A strength meter, direct CSV importer and aggregate onboarding metrics are planned, not active. No onboarding actions are measured or sent to us.