Frequently Asked Questions

Passary is a local-first password manager for logins and other private records. It encrypts your vault on your device and lets you choose where encrypted copies are stored. A Passary account is not required for core vault use.

The current Passary preview is free to use. It is under active development; check the release pages for the latest availability and limitations rather than assuming future release terms will stay the same.

The public desktop preview targets Windows 10 and 11. The optional web app works in browsers with the required Web Crypto and IndexedDB features; local-file and backup-folder capabilities vary by browser. Linux and mobile implementations are in development, but are not presented here as public releases.

The current V3 vault uses a random root key. Argon2id processes your master password, an optional keyfile is included in key derivation, and AES-256-GCM protects records and attachments. Older vault formats have different internals. Encryption does not protect an unlocked vault from malware or compromised app code.

A storage destination is not given your master password, keyfile, root key, or readable vault records. Passary does not need a provider-hosted vault for core use. You still have to trust the app, browser, device, and any code running while your vault is unlocked.

Vault contents are encrypted, but the file is not completely opaque. Its header and structure expose format and KDF parameters, vault and device identifiers, public keys, timestamps, record counts, and ciphertext sizes. A sync destination can also observe connection and object metadata.

No. You can create a vault with a master password alone. If you add a keyfile, the matching file is required for password-based unlock of that vault copy. Keep an exact backup of it separately from the encrypted vault and recovery kit.

For a supported V3 vault on Windows, you can explicitly enroll a local device grant and use Windows Hello or a device PIN to unlock on that Windows profile. It is optional and device-specific, not a portable replacement for your master password, keyfile, or independent backup.

A breach check is optional and requires consent. It sends a five-character SHA-1 hash prefix to the Pwned Passwords range service, not your complete password or full hash. That network request is separate from local vault encryption and storage.

The Windows app can create, unlock, edit, and save a local vault without an internet connection or Passary account. The web app can use a local vault after its code is available in the browser. Network-based sync and breach checks require a connection when used.

Yes, if you choose to configure it. Passary supports encrypted sync through a selected folder, WebDAV, S3-compatible storage, or a relay; you can also move an exported encrypted vault file yourself. A destination may retain old copies or be unavailable, so sync is not a substitute for a tested backup.

Passary supports imports from KeePass KDBX 3 and 4, Bitwarden JSON, and Google Password Manager CSV. Review the imported records before deleting your original database. Bitwarden and Google exports can contain plaintext credentials, so protect and remove those temporary files promptly.

The Chrome extension is available from the Chrome Web Store. Pair it with an unlocked Passary web vault in the same Chrome profile to fill supported forms without submitting them automatically. Keep the vault tab open. Firefox distribution is still pending review and signing; the Chrome download page explains setup and current Windows bridge compatibility.

A web vault and its snapshots stored in that browser's IndexedDB can be removed with site data. A separately saved .passaryvault file, exported recovery kit, or external backup is not restored automatically; you must import it and provide the credentials required for that copy.

Passary cannot reset it for you. An older encrypted vault or recovery kit may help if you still know the password and any keyfile that protected that particular copy. A local credential-rotation recovery copy may help after a recent change if it is still available and you know the older credentials.

Keep at least one encrypted copy separate from your primary device. You can back up a Windows vault file, export a web vault, create a .passarykit recovery kit, or configure an encrypted backup folder. Verify the copy by opening it with the credentials it requires; browser-only snapshots are not enough for device-loss recovery.

A .passarykit contains an encrypted V3 vault copy and restore instructions. It does not contain your master password or keyfile. A kit made before a credential change may require the older password and keyfile, so record which credentials belong to each copy.

Passary does not use vault contents for analytics or advertising. The website's hosting infrastructure may temporarily retain ordinary request logs such as IP address, requested page, and access time; retention depends on its configuration. Optional sync destinations and breach checks have their own data flows.

No tracking or advertising cookies are used. The website and web app use essential browser storage for preferences and encrypted local vault data. The Windows app stores vault files and local app state on your PC, not in website cookies.