Support

Help with PassAuth apps, the browser extension and the server.

Contact

Ask a question or report a problem on GitHub Issues. Please don't include passwords, codes or other vault contents in your report.

To report a security vulnerability privately, use Report a vulnerability on GitHub instead of a public issue.

Getting started

• You need a PassAuth server. Run your own (see the self-hosting guide) or ask the person who runs your organization's server for an account.
• Connect an app or the extension by entering the server's address (it must start with https://), then sign in with your email and master password.
• Turn on autofill. Android: in the app, Settings → Autofill opens the system setting where you choose PassAuth. iPhone and iPad: Settings → General → AutoFill & Passwords, turn on PassAuth. Mac (macOS 14 or later): install the desktop app and sign in, then in System Settings → General → AutoFill & Passwords turn on PassAuth; the extension reuses the app's server address, email and Secret Key, so you only type your master password. Browser extension: turn on "Make PassAuth your default password manager" in its settings so the browser stops offering to save passwords itself.

The desktop app

The desktop app lives in the menu bar on macOS and in the system tray on Windows and Linux. Closing the window keeps it running; quit it from the menu bar or tray icon. In Settings → Account → "This app" you can start it at login, show or hide the Dock icon on macOS, and change how often it syncs in the background (every 2 hours by default). It checks for a new version once a day and asks before installing. On Windows, the first run shows a SmartScreen warning because the installer isn't code-signed yet: choose "More info", then "Run anyway".

HTTPS and self-signed certificates

The apps and the extension connect to your server only over https://. Use a certificate from a public certificate authority, which most reverse proxies can obtain for you; the HTTPS section of the self-hosting guide shows how. A self-signed certificate is trusted only on devices where you've installed it as a trusted root, so phones, browsers and the desktop app will refuse the connection until you do.

I forgot my master password

Nobody can recover it, not even the server's administrator: your vault is encrypted with keys only your master password (and Secret Key, if you use one) can unlock. The account can only be deleted and created again. Write your master password down in your Emergency Kit and keep it somewhere safe.

I lost my Secret Key

Your Secret Key is in the Emergency Kit you saved when you created the account, and on every device where you've signed in. Without it you can't sign in on a new device.

Where is my Emergency Kit?

In the web vault, go to Settings → Account → Emergency Kit and print it or save it as a PDF. It lists your server's address, your email and your Secret Key, with room to write your master password. Keep it somewhere safe, offline, and keep your two-step login recovery codes with it.

I lost my two-step login device

Sign in with one of the recovery codes you saved when you turned on two-step login, then set up the new device again under Two-step login in Settings (Account security in the mobile apps). If you added a second method (for example an email code next to an authenticator app), you can use that instead. Without a recovery code or another method, you can't sign in; in that case ask your server's administrator for help.

Delete your account

Open your PassAuth server in a browser, sign in to the web vault, and go to Settings → Account → Delete account. This permanently deletes the account and all vaults you own. If you can't sign in, ask your server's administrator to delete it from the admin page. See also the privacy policy.

Running the server

Installation, the admin token, email, HTTPS, updates and backups are covered in the self-hosting guide.