Account and sign-in

There are two ways:

With your Emergency Kit. On the new device, enter the server address, your email address, Secret Key and master password. Everything except the master password is in your Emergency Kit.

With a device code. This works if another device is already signed in:

1. On the signed-in device, open Settings → Recovery → Add a device. Passbox shows a device code and a QR code. Both are valid for ten minutes.
2. On the new device, choose Use a code from another device and enter the code. On iPhone you can also scan the QR code with the Camera app.
3. The signed-in device shows the new device's name and IP address and asks whether it was you. Confirm with Yes, add this device.
4. Enter your master password on the new device.

Only your email address and Secret Key are transferred, encrypted. You always type your master password yourself.

With two-factor sign-in, signing in on a new device needs a second proof in addition to your master password. You set it up in the web app under Settings → Two-factor sign-in.

Authenticator app: Choose Set up, scan the QR code with your authenticator app and enter the first code.

Security keys and passkeys: Choose Add security key, enter a name and follow your browser. Security keys work for the address where you open Passbox in the browser. On your phone, in the browser extension and on the command line, use a code or a recovery code instead.

Recovery codes: After the first method, Passbox shows ten recovery codes. Each works once in case you lose your phone or key. Download them, print them or copy them to a safe place. Only then can you close the dialog.

When you sign in, Passbox asks for the code or key after the master password. Remember this device for 30 days skips this step on that device. You still need your master password every time.

Changing two-factor sign-in requires a sign-in within the last ten minutes. Otherwise Passbox asks for your master password and code again. Turning it off requires a current code, a recovery code or your security key. If your organization requires two-factor sign-in, you cannot turn it off.

Under Settings → Account → Change master password you choose a new one. Your Secret Key and your data stay the same. All other devices are signed out. Sign in there again with the new master password.

If you forgot your master password, see Account recovery.

• Devices: lists all signed-in devices. You can sign out single devices or Sign out all other devices.
• Activity: shows the last 50 security events of your account, such as sign-ins, failed attempts and changes to your master password and two-factor sign-in. Passbox detects a wrong master password on the device, so such attempts do not always appear in the list.
• Notifications: By default Passbox sends an email when a new device signs in. Turn it off under Settings → Notifications.

Passbox also emails you when your master password or two-factor sign-in changes and when your account is recovered.

Signing out removes your account and your Secret Key from this device. That is why Passbox asks first and offers to show your Emergency Kit once more. To lock without signing out, use Lock. You then unlock later with your master password only.

If your company uses single sign-on, sign in through your company account with Use single sign-on (SSO). What happens then is described in Single sign-on and SCIM.