SafePass user guide

SafePass is still under development. This guide describes the current Flutter client and its preview. Ask your SafePass server administrator for the API address. To try the preview, follow the README and use test data only.

Two separate passwords#

• The master password unlocks the local vault on a particular device.
• The server account password signs you in and enables sync with the SafePass API. It can differ from your master password.

Your recovery phrase has 24 words. SafePass keeps no copy of the phrase. Keep the phrase, passwords and vault contents out of chats and source repositories.

Create a local vault#

1. Choose to create a vault on first launch.
2. Set and repeat a master password of at least 12 characters.
3. Write down the 24 recovery words and keep them in a secure offline location.
4. Enter words 3 and 18 to check your backup, then select Confirm and open vault.

On subsequent launches, enter your master password and select Unlock. You can use the local vault without a server account.

Restore a local vault#

Use this flow if the encrypted vault is still available on the device and you forgot the master password.

1. On the lock screen, choose Recover with phrase.
2. Enter all 24 words and set a new master password of at least 12 characters.
3. Write down the new recovery phrase. The app replaces the old phrase, which stops working for this vault.
4. Confirm the new phrase by entering words 3 and 18.

Local recovery does not download remote data. If the vault files are missing or inaccessible, recovering cloud data requires a linked server account.

Link a new empty vault to a server account#

Install the client, create an empty local vault on the new device and confirm its recovery phrase. Link the vault before adding records. The client cannot replace an unsynced vault that contains data.

1. Unlock the empty vault and use the cloud button to open Server account.
2. Enter the configured SafePass API HTTPS address and the existing account UUID.
3. Enter the server account password and the 24-word account recovery phrase.
4. Confirm the master password you just set on this device.
5. Select the link action. After successful sign-in, the client starts syncing.

Use http://127.0.0.1:8080 only for a test API on that same device. For another device, configure HTTPS. The client uses the phrase to decrypt the shared vault key locally.

Reset a forgotten server account password#

Resetting the server password is separate from changing the local master password.

1. Open Server account and choose account password recovery.
2. Enter the API address, account UUID, recovery phrase and a new server account password of at least 12 characters.
3. On a new device with an empty vault, set a separate local master password for the device.
4. Sign in again on other devices after successful recovery. The server revokes prior sessions.

If the app asks you to update the account recovery envelope after local vault recovery, open Server account, sign in and enter the current recovery phrase there. Until you complete the update, the envelope on the server may still be tied to the old phrase.

Important limitations#

• Keep the phrase separate from the device and never share it. It can recover the vault key, and together with the account ID it can also reset the server account password.
• SafePass cannot recover a lost phrase. If you lose both the phrase and access to every device with the vault, the vault cannot be recovered.
• Use test data only in the preview until release and independent security review.