
      <h2>Three ways to unlock, and what each is for</h2>
      <p>Found under My → Security settings.</p>
      <table>
        <thead><tr><th>Method</th><th>Role</th></tr></thead>
        <tbody>
          <tr><td><strong>Master password</strong></td><td>The only credential that opens the data. The key derives from it and is never uploaded</td></tr>
          <tr><td><strong>PIN</strong> (6 digits)</td><td>Quick day-to-day unlocking</td></tr>
          <tr><td><strong>Biometrics</strong></td><td>Fingerprint or face, also for quick unlocking</td></tr>
        </tbody>
      </table>
      <p>One thing worth being clear about: <strong>a PIN and biometrics are conveniences, not a second lock.</strong> They save you typing the master password; the master password is still what protects the data.</p>
      <p>Biometric unlock is free, on the free tier too.</p>

      <h3>What happens if the PIN is wrong</h3>
      <p>Repeated failures trigger a cooldown that grows with each one, <strong>up to 24 hours</strong>. Restarting the app does not bypass it. One successful unlock by PIN or biometrics resets the count.</p>

      <h3>A caveat on Windows</h3>
      <p>With Windows Hello enabled, <strong>the system PIN also unlocks the vault</strong>. That is how the Windows interface works — an app cannot insist on a fingerprint. Anyone who knows your computer's sign-in PIN can open it; if that bothers you, leave Hello off and use the master password.</p>

      <h2>Auto-lock</h2>
      <p>Security settings → Auto-lock. Twelve intervals:</p>
      <p>Immediately / 30 seconds / 1 minute / 3 / 5 / 10 / 15 / 30 minutes / 1 hour / 4 hours / 8 hours / never.</p>
      <figure class="help-figure help-figure-portrait">
        <img src="/screenshoots/help/autolock.png" alt="Auto-lock settings screen with twelve interval options" loading="lazy" />
        <figcaption>The twelve intervals (screenshot shows the Chinese interface)</figcaption>
      </figure>
      <p>The default is <strong>1 minute</strong>.</p>

      <h3>Does switching apps lock it?</h3>
      <p>Not necessarily — <strong>it goes by the interval you set</strong>. Only once you have been away longer than that does coming back require verification.</p>
      <ul>
        <li>"Immediately": locks as soon as you leave</li>
        <li>"Never": stays unlocked (manual locking still works, from the vault screen)</li>
        <li>Everything else: locks after that much time away</li>
      </ul>
      <p>If unlocking feels too frequent, raise the value; lower it if you want to be stricter.</p>

      <h2>Two switches that are easy to miss</h2>

      <h3>Clipboard clearing</h3>
      <p>Clears the clipboard a while after you copy a password — <strong>30 seconds</strong> by default.</p>
      <p>Why it matters: the clipboard is shared system-wide and other apps can read it. Copy a password, forget about it, and it simply sits there.</p>

      <h3>Privacy mode</h3>
      <p>Blocks <strong>screenshots and screen recording</strong>, so passwords cannot leak through a screen capture.</p>
      <p>Off by default. Worth turning on if you often present or record your screen.</p>

      <h2>Changing the master password</h2>
      <p>Security settings → Change master password. Afterwards:</p>
      <ul>
        <li>Local data is unaffected; nothing needs re-importing</li>
        <li><strong>Other devices need the new master password to unlock</strong> — the account password and master password are the same thing</li>
      </ul>

      <h2>Related</h2>
      <ul>
        <li><a href="/help/security-checkup">Reading the security check</a></li>
        <li><a href="/help/recovery-key">What the recovery key is, and what happens if you lose it</a></li>
      </ul>
    

Unlocking and Auto-Lock


      <h2>Where to find it</h2>
      <p>The <strong>security score</strong> card sits in the middle of the app's home screen. "View details" opens the full <strong>password health check</strong>.</p>
      <p>The check runs on your device and <strong>uploads nothing</strong>.</p>
      <p>⚠️ It looks at <strong>passwords only</strong> — not 2FA codes, documents or payment cards.</p>
      <figure class="help-figure help-figure-portrait">
        <img src="/screenshoots/help/checkup.png" alt="Password health check: overall score, issue cards, strength distribution and suggestions" loading="lazy" />
        <figcaption>A results screen. <strong>Categories with nothing to report show no card</strong> — "not changed recently" is absent here because nothing in that vault is over 90 days old (screenshot shows the Chinese interface)</figcaption>
      </figure>

      <h2>What it looks for</h2>
      <h3>Weak passwords</h3>
      <p>Passwords that are short, guessable or easy to brute-force. Common words and plain alphanumerics get flagged.</p>

      <h3>Reused passwords</h3>
      <p>The same password across several accounts. This deserves attention before mere complexity — one breached site opens every account sharing that password.</p>

      <h3>Not changed in a long time</h3>
      <p>Passwords last changed more than <strong>90 days</strong> ago. This is the lowest priority of the three — a strong password does not weaken by sitting still, so treat it as a nudge rather than a fault.</p>

      <h3>Strength distribution</h3>
      <p>Counts and percentages across strong / medium / weak, so you can judge the overall state rather than just the number of bad ones.</p>

      <h2>How the score works</h2>
      <p>It starts at 100 and deducts per problem:</p>
      <table>
        <thead><tr><th>Problem</th><th>Each</th><th>Capped at</th></tr></thead>
        <tbody>
          <tr><td>Reused passwords (per group)</td><td>10</td><td>40</td></tr>
          <tr><td>Weak passwords</td><td>5</td><td>30</td></tr>
          <tr><td>Not changed in a long time</td><td>2</td><td>20</td></tr>
        </tbody>
      </table>
      <p>Three ratings: <strong>above 71 is good, 41–70 fair, 40 and below poor</strong>.</p>
      <p>The weightings show the priority: <strong>reuse costs the most</strong>, age the least — which matches the real risk.</p>

      <h2>Does a low score matter?</h2>
      <p>Treat it as a prompt, not an exam. <strong>Look at the individual findings rather than the number</strong> — three weak passwords on accounts you never use scores about the same as one weak password on your main email, and the real risk is nothing alike.</p>

      <h3>A sensible order</h3>
      <ol>
        <li><strong>Reused passwords first</strong>, especially on email, banking and payment accounts — those can be used to reset others</li>
        <li>Then <strong>weak passwords on accounts you actually use</strong></li>
        <li>Dormant accounts with nothing important attached can wait</li>
      </ol>

      <h2>How to fix one</h2>
      <p>Tapping a finding shows which entries it covers. To change a password:</p>
      <ol>
        <li>Change it on the site or app itself (KeyMe Pass cannot change someone else's password; it only remembers it)</li>
        <li>Generate the new one with the <strong>password generator</strong></li>
        <li>Update the entry in KeyMe Pass</li>
      </ol>
      <p>With autofill enabled, a site's change-password page will usually offer to save the new one for you, so step 3 takes care of itself.</p>

      <h2>Document expiry reminders</h2>
      <p>The home screen's alerts may also show an <strong>expired ID document</strong>. That comes from document entries and is separate from the password health check — it does not affect the score.</p>

      <h2>Related</h2>
      <ul>
        <li><a href="/help/security-settings">Unlocking and auto-lock</a></li>
        <li><a href="/help/organize">Item types and how to organize them</a></li>
      </ul>
    