Frequently asked questions.

No. Every KeyZula feature is free. No credit card, no trial period, no hidden fees.

No. All your items are encrypted on your device and reach the server only in encrypted form. Item names, usernames, website addresses and item types are encrypted too.

KeyZula doesn't know or store your master password, so it can't reset it. That's the price of your data staying yours alone. Keep your master password somewhere you won't lose it.

An attacker only gets encrypted data: your passwords, notes, item names and website addresses can't be read. Your master password isn't on the server; the server only stores a verifier derived from it, hashed again with Argon2id. Information the service needs to work, such as your email address, item count, organization memberships and device details, is visible. A long, unique master password plus two-step verification is your best protection. Details: Security.

Your master password is turned into a key on your device with Argon2id and is never sent to the server. Every item in your vault is encrypted with its own random key using XChaCha20-Poly1305. The server only stores and syncs this ciphertext; only you hold the key that opens it. The list of what the server can and can't see is on the How it works page.

Partly. The encryption library used by all our clients (key derivation, encryption, sharing) is open source (Apache-2.0) on GitHub: github.com/KeyZula/keyzula-crypto. The source code of the server, web vault, apps and extension is closed. We describe the overall design, and what the server can and cannot see, in detail in our security whitepaper (PDF).

KeyZula's servers are in Türkiye. Your vault contents are stored there in encrypted form only. Which personal data we keep and for how long is explained in our Privacy Policy.

Yes. Use "Transfer accounts" in Google Authenticator and upload screenshots of the QR codes to KeyZula; all your accounts come over at once. The image is decoded in your browser and never uploaded. You can also scan a 2FA QR code shown on a website directly from the page with the browser extension.

Yes. Upload the export file from Bitwarden, 1Password, LastPass, Chrome, Edge, Brave, Opera, Firefox or Safari on the Import page of the web vault; all your items, including folders, come over. The file isn't sent to the server; it's read and encrypted in your browser. You can also bring your 2FA codes over from Google Authenticator.

Yes. Besides the web vault there are apps for iPhone and iPad, Apple Silicon Macs and Android, plus a Chrome extension; Chromium-based browsers such as Edge and Brave can install the extension from the Chrome Web Store. You'll find the store links and review status on the Apps page.

Yes, both are available. Install the Firefox extension from Firefox Add-ons and the Safari extension with the KeyZula for Safari app on the Mac App Store; the links are on the Apps page. The Chrome extension is live too, and Edge, Brave and other Chromium-based browsers can install it from the Chrome Web Store.

The iOS and Android apps keep an encrypted copy of your last synced vault on the device, so you can view and copy your items while offline. The vault syncs again when you're back online. The web vault needs an internet connection.

Yes. When you create a passkey on a site, KeyZula saves it to your vault and syncs it end-to-end encrypted to all your devices. You can sign in to websites with passkeys in the browser extension and in the iOS and Android apps. You can also add a passkey for signing in to KeyZula itself; on trusted devices you won't need to type your master password.

Yes. In the Files section you can store documents such as IDs, passports or contracts, and you can also attach files to the items they belong to. Files are encrypted on your device before upload; our server can't see their contents. Every account gets 100 MB of free space for file attachments, up to 25 MB per file.

Yes. The KeyZula command-line tool runs on macOS, Linux and Windows; install it with Homebrew (brew install keyzula/tap/keyzula) or Node.js (npm i -g @keyzula/cli). Its built-in SSH agent offers the SSH keys in your vault to ssh and git; private keys never touch the disk. Setup and usage: Command line and SSH agent guide.

They let servers, CI jobs and AI agents read the secrets in selected collections of your organization, read-only. The token is created in the admin's browser and shown only once; the server can't read the secrets. Each token can be revoked on its own, and every read is written to the organization's audit log.

Yes. Create a free organization, invite your family members by email and share common items in a collection. Everyone's personal vault stays private. With emergency access, someone you trust can reach your vault if something happens to you.

Create an organization and invite your teammates by email. Set up departments and collections to decide who can view and edit which items.

Only you can see when items in your personal vault were viewed, copied or autofilled; organization admins never see them. Usage of shared (organization) items is visible to the organization's owners and admins; other members only see their own. Only the item's ID, the action, the time, the app, the device name and the IP address reach the server, never the item's name or contents. Logs are deleted after one year.

Soon. KeyZula is designed to run on your own server with Docker; the setup package hasn't been released yet. Until then, you can use the KeyZula cloud service for free.