Trust Center · Account security
Features that protect your account
Protecting sign-in and sessions matters as much as encrypting the vault. Here is what you can use today and what is on our roadmap.
Available
Available today for every account and organization.
- Available
Two-step login (TOTP)
A second step at sign-in with any authenticator app. The same code cannot be used twice and attempts are limited per account.
- Available
Passkeys (WebAuthn)
A second step with a passkey on your device or security key. Passkeys are bound to the domain, so they do not work on phishing sites.
- Available
Session and device list
See the browsers and extensions signed in to your account and sign out any of them, or all other devices, remotely. Access tokens expire after 15 minutes.
- Available
Re-authentication for sensitive actions
Turning off two-step login, removing a passkey, creating a new Emergency Kit, deleting your account, transferring organization ownership or deleting an organization requires your master password and, if enabled, a current second factor.
- Available
Security emails
You get an email when two-step login is added or removed, when your Emergency Kit is renewed and when your account is recovered.
- Available
Auto-lock and clipboard clearing
The vault locks after the period of inactivity you choose; keys stay in memory only while the vault is unlocked. Copied passwords are cleared from the clipboard automatically.
- Available
Emergency Kit
A 56-character recovery code that gets you back into your vault if you forget your master password. Using it signs out every session and generates a new code.
- Available
Audit log
In organizations, membership, sharing, key rotation and item changes are written to a log that cannot be altered. IP addresses are masked; the log can be exported as CSV.
- Available
Rotation checklist
When a member leaves, the vault key is rotated and the passwords and 2FA entries they could access are listed for you to change.
- Available
Lookalike address warnings
Domain names spoofed with lookalike letters (homographs) are shown with a warning and their real address; the extension fills based on the real domain.
- Available
Account deletion
You can permanently delete your account yourself in Settings (KVKK). It requires your master password and, if enabled, your second factor.
- Available
Organization security policies
Organization owners and admins can require two-step sign-in for members (enforced by the server), turn off moving shared items into personal vaults (enforced by the server; copying is restricted in the apps, but anyone who can read an item can always write it down elsewhere) and set a maximum auto-lock time for members (enforced in the app).
- Available
Vault security report
Analyses weak, reused, long-unchanged or breached passwords and insecure addresses on your device, with a one-click fix path for each finding. The server learns nothing from it.
- Available
Breach check (opt-in)
When enabled, your passwords are checked against known data breaches using k-anonymity: neither the password nor its full hash leaves your device; only the first 5 characters of the SHA-1 hash are sent to Have I Been Pwned.
- Available
Sign-in alerts
An email when your account is signed in to from a device not seen before, or after repeated failed sign-in attempts, so you can end that session in one click.
Our recommendations
- 1Choose a long, unique master password; a passphrase of several random words is a good choice.
- 2Add at least one passkey or authenticator app.
- 3Print your Emergency Kit and keep it somewhere safe outside your vault.
- 4Check your signed-in devices from time to time and sign out the ones you do not recognize.
- 5In organizations, verify your teammates' fingerprints out of band.
Get started
Start your vault in under a minute
Free for personal use. Your keys are created on your device — right now, in your browser.