PassflaresDocs
open_in_newOpen app
rocket_launchUser guide

Getting started

Create your account, sign in, manage your session and master password, and keep your account safe.

1. Creating your account

Click the Create account tab and fill in your email and a master password.

What makes a strong master password?

  • At least 12 characters
  • A mix of uppercase and lowercase letters, numbers, and symbols
  • Nothing from a dictionary or easily guessable

The strength indicator must reach at least Moderate before you can register. Use the Generate password button on any entry form for inspiration.

Important. Your master password cannot be reset. If you forget it, your encrypted data is permanently inaccessible. Store it somewhere safe.

2. Signing in

  1. Enter your email and master password on the Sign in tab.
  2. Click Sign in.
  3. Your encryption key is derived locally — your master password never leaves your device.
Session timeout. You are logged out automatically after 5 minutes of inactivity. Any mouse movement, keystroke, click, or scroll resets the timer.
Too many failed attempts? After 5 failed logins from the same IP address you will be locked out for 15 minutes.
Using two-factor authentication? After your master password you'll be asked for a one-time code — see the next section.

3. Two-factor authentication (2FA)

Two-factor authentication adds a second step to sign-in: after your master password, you also enter a one-time code from an authenticator app (Google Authenticator, Authy, 1Password, and similar). Even if someone learns your master password, they can't sign in without your authenticator. 2FA is optional and you turn it on yourself.

Turning it on

  1. Go to Settings and find the Two-factor authentication card.
  2. Click Enable 2FA, then Continue.
  3. Scan the QR code with your authenticator app, or type the shown secret in manually.
  4. Enter the 6-digit code your app generates to confirm.
  5. Save your recovery codes (see below), tick I have saved my recovery codes, then click Done.

Recovery codes

When you enable 2FA you are given 10 single-use recovery codes. Each code works once and lets you sign in if you ever lose access to your authenticator app. Copy or download them and store them somewhere safe — and separate from this password manager.

Don't lose both. If you lose your authenticator and your recovery codes you will be locked out: the server can't verify a second factor it never sees. Treat recovery codes like spare keys.

You can generate a fresh set at any time with Regenerate recovery codes — this invalidates the old set. The Settings card shows how many unused codes you have left.

Signing in with 2FA

  1. Enter your email and master password as usual.
  2. When prompted, type the current 6-digit code from your authenticator app.
  3. No app to hand? Click Use a recovery code instead and enter one of your saved codes.

Moving to a new phone (changing authenticator)

Switching authenticator apps or devices? Use Change authenticator in Settings.

  1. Click Change authenticator and confirm your master password plus a current code (or a recovery code).
  2. Scan the new QR code with your new app and enter a code to confirm.
Your old authenticator keeps working until the new one is confirmed, so there's no window where you're locked out. Your recovery codes are unchanged.

Turning it off

Click Disable 2FA and confirm with your master password and a current code (or a recovery code). This removes your authenticator secret and all recovery codes; future sign-ins need only your master password.

4. Navigating the app

Once signed in you will see four sections in the navigation rail:

  • Home — security overview and recent vaults.
  • Vaults — your personal and shared password vaults. See the Vaults guide.
  • Organisations — create and manage teams with shared vault access. See the Organisations guide.
  • Settings — appearance preferences (theme, density, shape, accent), account actions, and two-factor authentication.

Account-level actions (change master password, export, delete account) live in the user menu in the top right of the app bar.

5. Changing your master password

Changing your master password re-encrypts all your vaults with the new key. This may take a moment if you have many entries.

  1. Open the user menu and click Change master password.
  2. Enter your current master password, then your new master password (twice).
  3. Click Change password and wait — do not close the window during this process.
All vaults are downloaded, decrypted with your old key, re-encrypted with the new key, and re-uploaded. Your session updates automatically.

6. Exporting your data

Click Export vault data in the user menu to download a JSON file containing all your vaults in their encrypted form. The file is useless without your master password — store both safely. This is useful as an offline backup.

7. Deleting your account

This is permanent and cannot be undone.
  1. Open the user menu and click Delete account.
  2. Enter your master password to confirm.
  3. Click Permanently delete my account.

This removes: all personal vaults and their R2 data, your user record, and your organisation memberships. Organisation-owned vaults are not deleted. If you are the sole Owner of an organisation, assign another Owner before deleting your account.

8. Frequently asked questions

What if I forget my master password?

Your data cannot be recovered. There is no reset mechanism — this is deliberate, as the server never knows your master password.

I lost my authenticator — how do I get in?

Sign in with your master password, then click Use a recovery code instead and enter one of the recovery codes you saved when enabling 2FA. Once back in, go to Settings and either Change authenticator to set up a new device or Regenerate recovery codes. If you have lost both your authenticator and your recovery codes, no one — including the server operator — can verify your second factor for you.

Is my data backed up?

Vault data is stored in Cloudflare R2. Use Export vault data regularly to keep your own offline backup.

Can I use Passflares on my phone?

Yes — Passflares works in any modern mobile browser.

Why does it log me out so quickly?

The 5-minute inactivity timeout protects you if you step away from a shared device. Any interaction resets the timer.

Can anyone else see my passwords?

No. The server stores only encrypted ciphertext. Even if the server were compromised, an attacker would need your master password to decrypt anything.