How can we help?

Yes. Every feature is included at no charge. There are no paid plans, trials that expire, or password limits.

Signing up takes a few minutes, and every account ends up protected by two-factor authentication.

1. Open the registration page and choose a username, your email address and a master password.
2. Save the recovery key you are shown. It is the only way back into your vault if you forget your master password, and you see it only this once.
3. Open the link in the email we send you within 48 hours to verify your address.
4. Sign in, set up two-factor authentication with your authenticator app and save your backup codes.

Create an account

Check your spam folder first. The link stays valid for 48 hours, and you can ask for a new one at any time. An account that is never verified is removed after four days.

Send a new verification email

We can reset the password you sign in with, but only your recovery key opens your vault. It is the key you saved when you created your account, and without it your vault cannot be recovered.

1. Choose Forgot your password? on the sign-in page and enter your email address.
2. Open the link in the email within an hour and choose a new password.
3. Sign in and enter your recovery key when asked. Then confirm your new password, and your vault opens again.

Reset your password

Every account sets up two-factor authentication (2FA) when it is created. When you sign in, enter the 6-digit code from your authenticator app, or one of your backup codes if your phone is not at hand. If you have turned it off, set it up again with Setup 2FA under Profile settings, Password & Authentication.

Without your phone, sign in with one of your backup codes instead of a code. Each backup code works once. To move to a new phone, turn two-factor off under Profile settings, Danger Zone with a code from your current app, then set it up again on the new phone. You get new backup codes at the same time.

Yes. Add a passkey under Profile settings, Passkeys, which asks for your master password. After that, choose Sign in with a passkey on the sign-in page.

When you sign in from somewhere new, we hold the sign-in and email you first. Choose Confirm this location in the email, approve the sign-in and sign in again. If it wasn't you, don't approve it, and change your password.

Profile settings, Logged-in devices lists every device that is signed in, with its IP address and when it was last active. Sign out one of them, or choose Sign out all other devices.

Your vault locks itself after a time without activity, which you choose under Profile settings, Password & Authentication. You can also lock it yourself with Lock vault or Ctrl+Shift+L. Unlock it with your master password, or with a passkey set up to unlock it. If you have forgotten your master password, your recovery key gets you back in.

Yes. Set a PIN of 6 to 16 digits in your profile for the browser you use, or under Settings in the extension. After your vault locks, the PIN opens it again: on the website until you sign out, in the extension also after the browser restarts. Sycryptic only ever sees a key made from your PIN, and five wrong PINs turn PIN unlock off until you set a new one. The PIN needs a connection, your master password is still asked every 14 days, and signing out removes the PIN.

Logins, payment cards, identities, secure notes and recovery codes. Everything is encrypted in your browser before it is saved. A login can hold several web addresses, an authenticator key for two-factor codes and fields of your own, and logins and identities can hold files.

A login can use a password, single sign-on with a provider such as Google or Microsoft, a passkey or a PIN, and shows only the fields that kind needs. Add several web addresses and choose where the browser extension suggests the login, keep an authenticator key so the login shows its two-factor code, and add fields of your own. The question mark beside each part of the form walks you through it.

Yes, to logins and identities. Each file can be up to 10 MB, and all your attachments share 250 MB. Files are encrypted in your browser before they are stored, and decrypted there when you preview or download them.

Add the entries you use most to your favorites, and give items tags: type a tag in an item's Tags field, or choose Select on an overview and then Tags to tag several at once. Filter an overview by one or more tags, or search for a tag's name. Manage tags renames, recolors or deletes them. Tags are yours alone: nobody else sees them, also on items shared with you.

Deleted items stay in the Trash for 30 days, where you can restore them or delete them forever. Earlier versions of a password are kept too: open it, choose Show history and then Restore this version.

Password health points out passwords that are weak, reused, found in known data breaches or older than 12 months. Breaches are checked with Have I Been Pwned without sending your passwords: only the first five characters of each password's hash leave your browser.

Yes. Breach monitoring checks the email address on your account against known breaches with XposedOrNot once a week. It is on by default, and you can turn it off under Profile settings, Breach monitoring.

Open a saved password, choose Share and add other Sycryptic users by their email address. They get Can view or Can edit. Only the owner of a password can share it, and Manage sharing lets you change access or stop sharing at any time. Secure notes and recovery codes cannot be shared.

Add people you trust under Profile settings, Emergency access and choose a wait time between 1 and 30 days. When one of them asks for access, you get an email and can reject the request. If you do not, they can read (not change) your vault once the wait time has passed.

Secure Send shares a text or one file through a link. Your browser encrypts it before it is uploaded, and the key that opens it is part of the link, after the # sign. Browsers do not send that part to our server, so what we store stays encrypted. The recipient opens the link in their own browser, which decrypts it there, so they do not need an account. The link first shows only a button: a view is used when the recipient chooses to open the Send, not when a chat app shows a preview of the link.

Anyone who has the whole link can open the Send, so give it only to the person it is meant for. For more protection, add a password and tell it to them another way, for example by phone. Keep the expiry and the number of views as low as works for you: a Send expires after 1 hour, 1 day, 3 days or 7 days, and can be opened once, 3 times, 10 times or as often as needed until then. If your recipient finds a one-time Send already used, someone else may have opened it first. Change what it held then, such as a password.

Yes, one file of up to 10 MB per Send, encrypted in your browser like a text and with an optional note. Your active file Sends can take up to 100 MB together, separate from the room for attachments in your vault, and that room comes free again when a Send ends. Before opening, the recipient sees only the size of the file. A file attached to a vault entry can be sent from there too.

Yes. Revoke its link on the Secure Send page and it stops working right away, and a file is deleted at once. Revoking cannot undo what already happened: text the recipient copied or a file they downloaded stays with them, so change a password you sent if that matters. Sends that ended because they were revoked, used up or expired stay in your list for 7 days and are then removed. The file of a Send that expired or was used up is deleted within about two hours.

Send files are left out of our nightly backups, so once a file is deleted it is gone from our servers. Text Sends are part of the database, and its encrypted backups can still hold one for about 30 days after it is removed. It stays encrypted there, and the backups hold no readable key for it.

Yes, from a CSV export of 1Password, LastPass, Dashlane, KeePass, your browser or another manager, or from Bitwarden's unencrypted JSON export, up to 10 MB. The file is encrypted in your browser before it is uploaded. Password-protected exports from other managers cannot be read.

1. Export your passwords from your current manager as a CSV file, or from Bitwarden as an unencrypted JSON file.
2. Open Import & export on your dashboard and choose Upload and preview.
3. Check the preview and choose Confirm import.

Import & export on your dashboard offers three kinds of export: an encrypted backup that opens only in your own vault, a passphrase-protected backup that opens in any Sycryptic vault, and an unencrypted CSV for other password managers. The same place restores a Sycryptic backup, and backup reminders in Profile settings tell you when you haven't exported for 30 days.

Yes. Install the extension, sign in with your Sycryptic account, and use autofill on supported sites without paying anything extra.

Chrome, Edge and Firefox 140 or later. Install it from your browser's own store, linked on the browser extension page.

See the browser extension

With the same email address and master password you use on the website, or with a passkey you added there: choose Sign in with a passkey and confirm it on the Sycryptic page that opens. Finish setting up two-factor authentication on the website first.

Yes, to read. While Sycryptic cannot be reached, or your sign-in has expired without a connection to sign in again, the extension opens an encrypted copy of your vault from its last sync. You can view and copy logins, notes and codes, fill logins, cards and identities, and sign in with your passkeys. Changes wait until you are online again. The copy opens only with your master password, stays encrypted on your device and is removed when you sign out. You can turn it off under Settings, Keep an offline copy.

Both are in Profile settings. A new email address needs your master password, and it is only used once you confirm it from the email we send to it. To change your master password, choose Change password under Password & Authentication.

Passwords stay hidden on screen until you press the eye beside them, and the copy button works either way. That protects them when someone looks along or you share your screen. To see them straight away, turn on Show passwords in Profile settings.

Choose Delete Account under Profile settings, Danger Zone and confirm with your master password. Export your vault first if you want to keep a copy.

The Security page explains how your vault is encrypted and protected, and the Privacy Policy explains what data we keep and why.

Security Privacy Policy