Frequently asked questions
How does WolfPass work?
Your master password never leaves your device. The browser transforms it with Argon2id and derives two keys: an access proof, the only thing sent to the server, and one that unlocks your account key and never travels. The server stores only a hash of the access proof.
What does the server see of my data?
Only encrypted data. Every password, card or note is encrypted on your device with its own key (XChaCha20-Poly1305) and that key is encrypted with your account key. The site name, username and folders are also encrypted.
What are the advantages?
Zero-knowledge: neither the server nor the WolfPass team can open your vault. Invite-only signup. Email confirmation if someone logs in from a new country or device. Two-step verification. Same encryption and data on the web, the browser extension and the Android app. Password generator and one-time codes (TOTP) for your sites. Import from Chrome, Bitwarden and NordPass.
What if I forget my master password?
No one can open your vault for you. When you create your account you get 8 single-use recovery codes: each lets you choose a new password without losing your data. If you lose the password and the codes, the only option is to reset the account by email, which deletes your whole vault.
When does my session close?
On the web, the session closes after 15 minutes without activity. On the Android app it locks after 15 minutes away from the app and always after 8 hours. In the extension you choose in Settings between closing after 15 minutes without using WolfPass, staying open while you browse or use the device (max 8 hours), or staying open until you close it manually. Locking is not closing the session.
Where is the trash?
In the side menu, "Trash". Deleted items stay there 30 days; you can restore them or delete them forever.
How do I use WolfPass in my browser and phone?
Install the browser extension and the Android app with the same account. On the phone, enable WolfPass as an autofill service from the app settings; each browser decides whether to use it, and you do that step in the browser.
What can't WolfPass promise?
WolfPass hasn't undergone an external audit yet. If your device has malware, it can read your vault while it's unlocked: encryption protects what's stored, not a compromised device.