
      <h2>Three ways to start</h2>
      <p>When you first open KeyMe Pass, there are three paths:</p>
      <table>
        <thead>
          <tr><th>Option</th><th>When to use it</th><th>Network</th></tr>
        </thead>
        <tbody>
          <tr><td><strong>This device only</strong></td><td>No account; data stays on this device</td><td>No</td></tr>
          <tr><td><strong>Create an account</strong></td><td>You plan to use several devices</td><td>Yes</td></tr>
          <tr><td><strong>Sign in</strong></td><td>You already have an account</td><td>Yes</td></tr>
        </tbody>
      </table>
      <p>Local-only use needs no email address and sends nothing to our servers. You can register later; existing data is kept.</p>

      <h2>The master password</h2>
      <p>The master password unlocks your vault. It is <strong>never uploaded</strong> — our servers hold neither it nor anything from which it could be reconstructed.</p>

      <h3>How it relates to your account password</h3>
      <p><strong>They are the same password.</strong> KeyMe Pass enforces this by design; there is no state where the account password is one thing and the master password another.</p>
      <p>So when sign-in reports a wrong password, the master password itself is wrong — there is no second password to have confused it with.</p>

      <h3>Choosing one</h3>
      <p>The master password is the only barrier protecting the vault:</p>
      <ul>
        <li>Make it long (past 12 characters, length beats symbol soup)</li>
        <li>Do not reuse it from another site</li>
        <li>Make it something you will remember — forgetting it is costly, see below</li>
      </ul>
      <p>It is put through Argon2id with a 64 MiB memory cost, which raises the hardware cost of large-scale offline cracking considerably.</p>

      <h2>The recovery key</h2>
      <p>After setting the master password you are shown a <strong>recovery key</strong>, and must confirm you have stored it before continuing.</p>
      <p><strong>It is shown only once</strong>, and it is the only way back in if you forget the master password. Write it down and keep it offline.</p>
      <p>See <a href="/help/recovery-key">What the recovery key is, and what happens if you lose it</a>.</p>
      <p>Note: signing in with an existing account on a new device does not show it — that step belongs to account creation only.</p>

      <h2>PIN and biometrics (optional)</h2>
      <p>You can then set a <strong>6-digit PIN</strong> for quicker day-to-day unlocking, and enable fingerprint or face unlock.</p>
      <p>Understand what they are: <strong>a PIN and biometrics are conveniences, not a second lock.</strong> The master password is what actually protects the data.</p>
      <p>Repeated wrong PIN entries trigger a cooldown that grows with each failure, up to 24 hours. Restarting the app does not bypass it.</p>

      <h2>Next steps</h2>
      <ul>
        <li>Bring data over from another manager → <a href="/help/import">Import guide</a></li>
        <li>Fill passwords on sign-in pages → <a href="/help/autofill">Autofill</a></li>
        <li>Use it on a computer → <a href="/help/extension">Browser extension</a></li>
      </ul>
    

Creating Your Account and Master Password


      <h2>What it is for</h2>
      <p>KeyMe Pass uses end-to-end encryption. Your <strong>master password is never uploaded</strong>, and what sits on our servers is ciphertext. One consequence follows directly from that: we cannot reset your master password, and we cannot decrypt your data.</p>
      <p><strong>The recovery key is the only way back in if you forget your master password.</strong> It carries the highest level of access to your account — anyone holding it can reset the master password and read everything.</p>

      <h2>What it looks like</h2>
      <p>26 characters, displayed in groups of four:</p>
      <pre><code>XXXX-XXXX-XXXX-XXXX-XXXX-XX</code></pre>
      <p>The final character is a checksum, so a transcription error can be detected. The character set excludes I, L, O and U to avoid confusion.</p>

      <h2>When it is shown</h2>
      <p>During <strong>account creation</strong>. You must tick "I have stored this offline and will not share it" to continue; the step cannot be skipped.</p>
      <p>Screenshots are <strong>permitted</strong> on that screen, unlike elsewhere in the app.</p>

      <h3>⚠️ Shown only once</h3>
      <p>Once you leave that screen, the recovery key <strong>cannot be viewed again</strong>. There is no place in the app to retrieve it.</p>
      <p>The reason is technical: the recovery key is a random value, and the device stores only a one-way derivation of it. The original cannot be reconstructed. This is not a missing feature — it is not possible by design.</p>
      <p>Also note: <strong>signing in with an existing account on a new device does not show the recovery key again.</strong> Changing phones is not a second chance to obtain it.</p>

      <h2>How to store it</h2>
      <ul>
        <li><strong>Write it on paper</strong> and keep it with your important documents</li>
        <li>Or put it in an <strong>offline</strong> safe</li>
      </ul>
      <p>Not advisable:</p>
      <ul>
        <li>❌ Cloud photo libraries, chat apps, email, notes apps</li>
        <li>❌ Inside KeyMe Pass itself — if you forget the master password you cannot open it</li>
      </ul>

      <h2>If you lose it</h2>
      <p>Two cases.</p>

      <h3>Case 1: you still know the master password</h3>
      <p>Your data is unaffected. Generate a new recovery key in the app and store it properly.</p>

      <h3>Case 2: both the master password and the recovery key are gone</h3>
      <p>The encrypted data <strong>cannot be recovered</strong>. The only remaining option is to reset the account through your registered email address.</p>
      <p><strong>Resetting clears your cloud data.</strong> The account stays usable, but what was synced to the cloud will not be kept.</p>
      <p>If any device is still unlocked, <strong>export your data first</strong>, then reset. Export is free and unlimited.</p>

      <h2>Related</h2>
      <ul>
        <li><a href="/help/forgot-master-password">If you forget your master password</a></li>
        <li><a href="/help/account-setup">Creating your account and master password</a></li>
      </ul>
    

What the Recovery Key Is, and What Happens If You Lose It


        <h2>What data can be imported?</h2>
        <p>KeyMe Pass imports <strong>passwords</strong> and <strong>MFA (2FA)</strong> data from many password managers and authenticators, making migration from other tools easy.</p>

        <h2>Supported sources and formats</h2>
        <h3>Password managers</h3>
        <table>
          <thead><tr><th>Source</th><th>Format</th><th>What comes across</th></tr></thead>
          <tbody>
            <tr><td>KeyMe Pass itself</td><td>JSON / CSV / ZIP</td><td>Everything</td></tr>
            <tr><td>1Password</td><td><strong>1pux</strong> / CSV</td><td>Logins + MFA + documents + cards + notes + SSH<br><small>1pux is the full export (with attachments); CSV covers logins only</small></td></tr>
            <tr><td>LastPass</td><td>CSV</td><td>Logins + MFA + documents + cards + notes + SSH</td></tr>
            <tr><td>Bitwarden</td><td>JSON</td><td>Logins + MFA + documents + cards + notes + SSH</td></tr>
            <tr><td>Proton Pass</td><td>ZIP / JSON / CSV</td><td>Logins + MFA + documents + cards + notes + SSH<br><small>Unencrypted exports only</small></td></tr>
            <tr><td>Enpass</td><td>JSON / CSV</td><td>Logins + MFA + documents + cards + notes</td></tr>
            <tr><td>Dashlane</td><td><strong>ZIP only</strong></td><td>Logins + MFA + documents + cards<br><small>Its export is several CSVs in one archive — import the whole archive</small></td></tr>
            <tr><td>KeePass</td><td>XML</td><td>Logins + MFA</td></tr>
            <tr><td>Chrome passwords</td><td>CSV</td><td>Logins</td></tr>
            <tr><td>Passwords app (Mac)</td><td>CSV</td><td>Logins</td></tr>
            <tr><td>Password Keyboard</td><td>CSV</td><td>Logins</td></tr>
          </tbody>
        </table>

        <h3>Authenticators (2FA codes)</h3>
        <table>
          <thead><tr><th>Source</th><th>Format</th></tr></thead>
          <tbody>
            <tr><td>Google Authenticator</td><td>JSON</td></tr>
            <tr><td>2FAS Auth</td><td>JSON / .2fas</td></tr>
            <tr><td>Aegis Authenticator</td><td>JSON</td></tr>
            <tr><td>Raivo OTP</td><td>JSON</td></tr>
            <tr><td>otpauth:// URI list</td><td>TXT</td></tr>
          </tbody>
        </table>

        <h2>How to import</h2>
        <p>The entry is at <strong>Me → Data management → Import</strong>. Pick the matching product under "Source" first, then choose the file — <strong>the wrong source will fail to parse</strong>, since each vendor exports a different field structure.</p>
        <figure class="help-figure help-figure-portrait">
          <img src="/screenshoots/help/import-sources.png" alt="The source picker, listing each supported product with the file formats it accepts" loading="lazy" />
          <figcaption>Choosing a source: each entry notes the file formats it accepts</figcaption>
        </figure>
        <ul>
          <li>Export your data from the source password manager / authenticator, then use the "Import" entry in KeyMe Pass to select the file.</li>
          <li>Supported fields vary slightly by platform — after importing, verify key fields (username, URL, notes, etc.).</li>
          <li>MFA import depends on what each platform exports; some exports include only essential 2FA fields.</li>
        </ul>
        <p>Imported data is end-to-end encrypted and stored in your local vault, just like everything else.</p>
    