How Can We Help You Protect Your Vault?

Your Emergency Secret Key is a unique 128-bit cryptographic code (formatted as PK-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX) generated directly in your browser when you create your PassKee account. It combines with your Master Password via Argon2id so no one can sign in to your vault from a new device using your password alone. During registration, you copy and confirm that you have saved this Secret Key before proceeding to sign in.

Because PassKee is built on strict zero-knowledge encryption, our servers never store your Master Password or Secret Key and cannot reset or recover them. If you lost your Secret Key but still have an unlocked session on an authorized device, immediately open Vault Actions (⋮) -> Backup -> Export to KeePass (.kdbx) to save your data, then create a new account. If both your Master Password and Secret Key are lost with no active session, your encrypted vault cannot be decrypted by anyone.

No. When signing in, check 'Remember Secret Key for quick unlock in this session'. PassKee encrypts your Secret Key in isolated browser sessionStorage using a key derived from your Master Password and Auth Salt via Argon2id. When your session locks after inactivity, the 'Unlock Session' screen only asks for your Master Password.

After 15 minutes of inactivity—or immediately when you click the Lock button in the header—PassKee closes all open modals, zeroes out your decrypted Private Key and active Vault AES Key in memory (RAM), and navigates to the Unlock Session screen. If you close the browser tab or click Logout, sessionStorage is completely cleared.

When you share an item, your browser strips any file attachments, generates a fresh 256-bit AES-GCM key, encrypts the item locally, and places the 64-character hex decryption key after the URL hash fragment (/share/{token}#{hexKey}). Browsers never send the # fragment to the server. You can set expiration to 1 hour, 1 day, 7 days, or 30 days, and optionally enable 'Can be viewed only once'.

From the Vault Actions (⋮) menu in the sidebar, you can import KeePass KDBX 3 and KDBX 4 databases (up to 100 MB) unlocked with a database password. All decrypting happens locally in your browser via WebAssembly, preserving directories, entries, tags, and file attachments. You can also choose Backup -> Export to KeePass (.kdbx) at any time to download an encrypted KDBX 4 archive (with archived items placed in a dedicated Archive directory).

No. PassKee servers store only raw binary ciphertext (PostgreSQL bytea). Each vault has its own 256-bit AES-GCM key wrapped with your Curve25519 (X25519) keypair, and both directory names and credential payloads are encrypted on your device before transmission.

PassKee supports 8 credential types: Login, Secure Note, Card, Password, File, Database, SSH Key, and Server—complete with custom icons, custom fields, sections, tags, file attachments, and an Archive folder. The top header also provides instant generators for random Passwords, PIN codes, and developer GUID/UUID v4/v7, Hex, and Base64 tokens.