Questions about the password manager
Short answers – including the uncomfortable questions.
Answers
What happens if I forget my master password?
Then you need your recovery key from the emergency sheet. With it you set a new master password; afterwards all keys are renewed. If you have neither the master password nor the recovery key, nobody can get to your passwords anymore – not us and not our support. Keep the emergency sheet in a safe place, for example printed out.
Can SafeDoc read my passwords?
No. Encryption happens on your device before anything is sent to us – including titles, folders and addresses. We only store encrypted data and have no key for it. What our server still sees (for example the number of your entries) is listed in full on the security page.
What does the password manager cost?
Passwords Basic is free in every account, including Free – with filling, generator, import, export and all security features. Passwords Plus costs €2.49 per month or €24.90 per year incl. VAT; it is included in Pro and Business Pro. The prices are still provisional; you can book Plus once they are final.
What does Passwords Plus add?
Authenticator codes (TOTP), password health with a full list and the last 10 versions per entry in the password manager. Plus adds convenience, not extra protection: security features are part of every tier.
What happens to my data if I cancel Plus?
Nothing is deleted. You keep using Plus until the end of the paid period. After that, Plus features are hidden: stored authenticator secrets are kept and come back when you book Plus again.
Which browsers is the extension available for?
The extension for Chrome, Edge and Firefox will follow – after the external audit. Without the extension you open your passwords in the web app in your browser.
Why is the extension more secure than the web app?
The web app loads its code from our server every time you open it. The extension loads its code from the browser’s store. If our server were attacked, it could deliver altered code to the web app, but not to the extension. That is why we recommend the extension as the most secure way.
How strong does my master password need to be?
Long and unique – ideally a passphrase of several random words. Argon2id with 64 MiB of memory and 3 passes makes every guess expensive, but cannot save a weak master password. It must not be your sign-in password; setup rejects identical or very similar passwords.
What is the secret key?
A second, random key that only lives on your devices. It protects your data even if someone obtains the encrypted data and your master password is weak. You enter it once on every new device. It is optional.
Can I bring my passwords from Chrome or another manager?
Yes. The import reads exports from Chrome, Edge and Firefox as well as Bitwarden, 1Password and KeePass(XC) and shows a preview before anything is taken over. You can export at any time as CSV or JSON, encrypted too – in every tier.
Where are my passwords stored?
Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. Your passwords are only stored there in encrypted form.
Has the encryption been examined by an independent party?
The password manager is in beta: it works, but the encryption has not yet been externally reviewed. An independent cryptography audit is planned. So create your emergency sheet and export your passwords regularly.
Beta: the password manager works but has not yet been externally reviewed. Create your emergency sheet and export your passwords regularly. We open the beta step by step. After signing up, you request access with one click.