How-to guide

Getting started

1. Create your account. Choose Get started, enter your name and email, and pick a master password. This is the only password you'll need to remember, so make it long — a short sentence like purple kangaroo eats 4 pies works well.
2. Save your recovery key. You'll be shown a key made of 8 groups of letters and numbers. Download or print it and keep it somewhere safe and offline. It's the only way to reset your master password without losing your data.
3. Confirm your email using the link we send you.
4. Add your first items. Click New item in the sidebar.

Adding a password

1. Click New item and make sure Login is selected.
2. Give it a name you'll recognise (e.g. "Netflix" or "ANZ Bank").
3. Enter the username or email you log in with.
4. Type the password — or press the dice button to generate a strong new one. The bar underneath shows how strong it is.
5. Add the website (e.g. netflix.com) so you can open it with one click.
6. Optionally add notes, choose a folder, and press the ☆ star beside the name to make it a favourite. Then press Save.

Changing a password on a website? Generate the new one in PasswordPal first, save it, then paste it into the website — that way you'll never lose it.

Adding a secure note

Secure notes are for anything private that isn't a login: Wi-Fi passwords, alarm codes, licence keys, passport numbers, bank details, recovery phrases.

1. Click New item and choose the Secure note tab.
2. Give it a name, type or paste your text in the Note box, and press Save.

Notes are encrypted exactly like passwords. Each one can hold about 150 KB of text.

Copying, editing & deleting

• View: click any item in the list. Passwords are hidden — press the eye to show one.
• Copy: press the copy button next to a username, password or note. Your clipboard is cleared automatically after 30 seconds.
• Open the website: press the arrow button next to the website.
• Edit: press Edit, make your changes and Save.
• Delete: press the bin icon. Deleting can't be undone.

Folders, favourites & search

• Folders: pick a folder from the Folder dropdown when adding or editing an item, or choose + New folder…. To move an item, edit it and choose another folder. Manage folders in Settings.
• Favourites: press the ☆ star next to the name in the editor, or Favourite on an item. Find them all under Favourites in the sidebar.
• Search: type in the search box at the top. It looks through names, usernames, websites, folders and note text — and runs on your device, so your searches stay private.
• Filters: use Logins, Secure notes and Shared with me in the sidebar to narrow the list.

Managing folders

Open your name (top right) → Account settings → the Folders tab.

• Add a folder by typing a name and pressing Add folder. Empty folders stay until you delete them.
• Rename a folder and every item in it moves to the new name.
• Delete a folder — the items in it are kept and simply have no folder.

You can also choose a folder, or + New folder…, from the Folder dropdown when adding or editing an item. Folders are for your own items; family and team items use collections.

Password generator

Open Generator in the sidebar.

• Password mode: choose the length (16–20 is a good default) and which characters to include. Tick Avoid look-alike characters if you'll ever need to read it out or type it on a TV.
• Passphrase mode: random words joined together — great for passwords you have to type, like your computer login.
• Press the copy button to copy it, or the arrows for a new one. Your settings are remembered and used by the dice button in the item editor.

Security check

Open Security check in the sidebar to see your security score and which passwords need attention: weak, reused, older than a year, or saved with an insecure http:// website.

Press Check for breached passwords to compare your passwords against known data breaches. Only the first five characters of a scrambled (hashed) version of each password leave your device, so your passwords stay private. Press View next to any result to open the item and change it.

2FA codes in your items (Premium)

PasswordPal can generate the 6-digit two-factor codes for the websites you use, so you don't need your phone to log in.

1. On the website (for example Google, Microsoft or GitHub), go to its security settings and turn on two-factor authentication with an authenticator app.
2. When it shows a QR code, look for "Can't scan it?" or "Enter a setup key" and copy the key. Or take a screenshot of the QR code.
3. Edit the login in your vault and paste the key into Authenticator key (2FA). You can also paste the screenshot straight into that box, or press QR image and choose the screenshot.
4. The editor shows the current code. Type it into the website to finish setting up, then save the item.

From then on the item shows a live one-time code with a countdown. Press the copy button and paste it when the website asks. Keys are end-to-end encrypted like the rest of the item. If you share the item, the other person gets the codes too.

Tip: set it up here and on your phone

You can use the same 2FA for a website both in PasswordPal and in an authenticator app on your phone (such as Microsoft Authenticator or Google Authenticator). Both produce exactly the same codes, so you can use whichever is closer. Each one is also a backup for the other: if you lose or replace your phone, your codes are still here, and if you can't get to your vault, your phone still has them.

The trick is to add the key to both at the same time, while the website's setup screen is still open. Many websites only show the key once.

1. On the website, start setting up two-factor authentication with an authenticator app, and leave the QR code on screen.
2. On your phone: open your authenticator app, tap + (add account) and scan the QR code.
3. In PasswordPal: edit the login and add the same setup key (from "Can't scan it?") or a screenshot of the same QR code to Authenticator key (2FA).
4. Check that your phone and PasswordPal show the same 6-digit code. Then type it into the website to finish, and save the item.

Already set up 2FA on your phone? Most websites don't show the key again. To add it here, turn 2FA off and on again for that website (or choose "change authenticator app" if it offers it), then follow the steps above. The old phone entry will stop working, so add the new one on your phone too.

If you take a screenshot of a QR code, delete it once you've finished. Anyone with the screenshot could create your codes. Keeping passwords and 2FA codes in the same vault is very convenient, but it means anyone who gets into your vault has both. For your most important accounts (like your email), you might choose to keep 2FA on your phone only.

Two-factor authentication with Microsoft Authenticator

Two-factor authentication (2FA) asks for a 6-digit code from your phone each time you log in. Any authenticator app works; these steps use Microsoft Authenticator.

1. On your phone, install Microsoft Authenticator from the App Store or Google Play.
2. In PasswordPal, click your name at the top right → Security, 2FA & passkeys → Set up two-factor authentication. A QR code appears.
3. In Microsoft Authenticator tap + (Add account) → Other account (Google, Facebook, etc.) and point your camera at the QR code. Can't scan it? Tap Or enter code manually and type the setup key shown under the QR code.
4. "PasswordPal" appears in the app with a 6-digit code. Type that code into PasswordPal and press Turn on.
5. Save your 10 backup codes — download, print or copy them somewhere safe. Each works once if you lose your phone.

Logging in with 2FA

Enter your email and master password as usual, then open Microsoft Authenticator and type the current code for PasswordPal. It's accepted automatically once you've typed 6 digits.

Lost or replaced your phone?

• Log in and type one of your backup codes instead of the 6-digit code.
• Then go to Security → Turn off 2FA and set it up again on your new phone — or press New backup codes if you still have the authenticator but have used up your codes.
• No phone and no backup codes? Contact us. We'll verify your identity before removing 2FA.

"Invalid code"?

Codes depend on the time. Check your phone's date and time are set automatically, wait for the next code and try again.

Passkeys

A passkey lets you log in with your fingerprint, face, device PIN or a security key instead of typing your password and a 2FA code.

1. Click your name → Security, 2FA & passkeys → Add a passkey, and confirm your master password.
2. Follow your device's prompt (Face ID, Touch ID, Windows Hello, your phone or a security key).
3. If asked, confirm once more so the passkey can also unlock your vault.

Next time, press Log in with a passkey on the login screen. Each passkey is labelled either Signs in & unlocks vault (no master password needed on that device) or Sign-in only (you'll type your master password to unlock — that device can't decrypt the vault by itself). When your vault is locked you'll also see Unlock with a passkey.

To remove a passkey, press the bin icon next to it, and delete it from your device or password manager too. More about passkeys.

Sharing an item (Premium)

1. Open the item and press Share.
2. Type the person's email address — they need a PasswordPal account, but a free one is fine.
3. Choose Can view or Can edit and press Share.
4. Check the name and email (and, for extra safety, ask them to read you the key fingerprint from their Security settings), then confirm.

The item appears under Shared with me in their vault. To change permissions or stop sharing, open the item → Share and use the menu or the ✕ next to their name. If you remove someone's access, change the password if they might have seen it.

Families & teams

Create one

1. Click your name → Families & teams, then Create a family (up to 6 people) or Create a team (billed per seat).
2. Give it a name. Your first one starts with a 7-day free trial. You'll find it in your sidebar with a starting collection.

Invite people

1. Open it (the cog next to its name in the sidebar) → Members.
2. Enter an email address, choose Member or Admin, and press Invite.
3. If they already have an account, you'll be asked to check their name and key fingerprint, and they'll be confirmed as soon as they accept. If not, they'll get an email to create a free account and join.
4. People who joined from an email invitation show Needs confirming. Press Confirm — this securely gives them the family/team key. Until then they can't see shared items.

Collections

Collections are shared folders. Under Collections you can create more (e.g. "Bills", "Streaming", "Kids") and choose who can use each one: everyone, or specific people with view-only or edit access. Owners and admins can always see everything.

To add an item, select the collection in the sidebar and press New item, or choose the collection in the Save in box. To move one of your own items in, edit it and change Save in to the collection.

Roles

Transferring ownership

The owner can hand a family or team to another confirmed member under Settings → Transfer ownership (you'll confirm with your master password). The new owner controls billing and can delete it; you become an admin. If it has a subscription, the new owner should update the payment details under Billing → Manage subscription.

Leaving or removing someone

Members can leave from Settings on the family/team page. Owners and admins can remove members with the ✕ on the Members tab. Removed people lose access straight away, but may have seen passwords already — change anything important.

Teams can also require two-factor authentication or a passkey for everyone, under Settings.

Import & export

Import

1. Export your passwords from your browser or old password manager as a CSV file (in Chrome: Settings → Passwords → Export passwords; in Edge: Settings → Profiles → Passwords → ⋯ → Export). Bitwarden JSON files also work.
2. In PasswordPal, click your name → Import / export, choose the file and press Import.
3. Everything is encrypted on your device before it's uploaded. Delete the export file afterwards — it isn't encrypted.

Export

Choose Export JSON or Export CSV and confirm your master password. The file contains your passwords in plain text, so store it carefully and delete it when you're done. Exports include the items you own, not items shared with you or in family/team collections.

Locking & auto-lock

Press the padlock at the top of the screen (or Lock vault in the account menu) to lock your vault. This wipes decrypted data from memory but keeps you signed in, so you only need your master password (or a passkey) to open it again.

Your vault also locks itself after a period of inactivity. Change how long under Account settings → Auto-lock vault after. Log out ends your session completely. Lost a device? Use Sign out all other devices under Security.

Locked out after failed logins

To stop people guessing, your account is locked for an hour after 5 wrong master passwords or 2FA codes in a row, and we email you. While it's locked you can still:

• log in with a passkey if you've added one;
• reset your master password using your recovery key (this also clears the lock);
• contact us to unlock it after we've confirmed it's you.

Got a lock email but it wasn't you? Your vault is still safe — it can't be opened without your master password — but consider turning on two-factor authentication.

Changing your email address

1. Open your name → Account settings → Change email address.
2. Enter the new address and your master password (and your 2FA code if it's on).
3. Click the confirmation link we send to the new address within 24 hours. Your old address gets a notice too.

Your vault, master password, recovery key and passkeys all stay the same. Families and teams you belong to see your new address.

Profile pictures & website icons

If you have a Gravatar for your email address, it's shown as your picture (and other people's in families and sharing). Logins with a website show that site's icon instead of a letter. Turn either off under Account settings → Pictures & icons — see the privacy policy for exactly what each one shares.

Forgot your master password

1. On the login page choose Forgot password? and enter your email. We'll send a reset link that works for one hour.
2. Open the link and choose I have my recovery key. Type the key (capitals and dashes don't matter), choose a new master password and press Reset. All your items are kept.
3. No recovery key? Choose I don't have my recovery key. Your account is kept, but the items in your vault are permanently erased because nobody — including us — can decrypt them. You'll get a new recovery key; keep this one safe.

Lost your recovery key but still know your master password? Create a new one any time under Security → Create a new recovery key.

Plans, trial & billing

• Free: up to 8 passwords and notes, 2FA, passkeys, generator and security check, and you can receive shared items.
• Premium ($12 / year): unlimited items, sharing and 2FA codes in your items.
• Family ($24 / year): Premium for up to 6 people plus shared collections.
• Teams ($4 / user / year, minimum 4 seats — from $16 / year): Premium per seat, roles, access control and an activity log. Add seats any time as your team grows.

Free trial: new accounts get 7 days of Premium automatically, with no card needed. A family or team you create during that time shares the same trial and ends on the same day. When a trial ends you move to the Free plan. Nothing is deleted, but only your first 8 items stay available: any above that are locked until you upgrade, though you can still export them. You also can't start new shares or add new 2FA keys; keys you already saved keep working.

Paid plans renew automatically once a year. We email you 7 days before each renewal with the date and amount, and the renewal date is always shown under Plan & billing. Upgrade under Plan & billing. Payments are handled securely by Stripe — we never see your card details. To change your card, download invoices or cancel, choose Manage subscription. If you cancel, Premium continues until the end of the period you've paid for.

Deleting your account

Go to Account settings → Delete my account, type DELETE and confirm with your master password (and 2FA code if it's on). Your account, vault and shares are deleted immediately and any subscription is cancelled. If you own a family or team, it's deleted for everyone too, so let your members know first. Export your data beforehand if you want to keep a copy.