Frequently asked questions

Open Create password, type a long phrase only you could know, and watch the strength feedback — improve the phrase until it stops warning you. Pick a length (24 is the default) and press Generate. Remember: the password does not update any website by itself — set it at that website before logging in with it.

After generating, press Create QR. You can download the QR image, download the password as a text file, or print a wallet-size card. These copies are readable by anyone who holds them — for storage, prefer the separate “Save protected copy” option, which encrypts the password under an unlock phrase you choose.

Open Restore password and load the QR image or saved file, or scan a printed card with your camera. A protected copy additionally asks for its unlock phrase. The restored password can be revealed or copied — nothing is sent anywhere.

Re-enter exactly the same phrase with the same length and version on the Create page: the calculation is deterministic, so identical inputs reproduce the identical password. Capitalization, punctuation, word order and the selected length all matter — any change produces a different password.

On your computer, open Restore and choose “Scan with Mobile”. Scan the pairing QR with your phone, compare the six-digit code shown on both screens, then approve the transfer. The password travels end-to-end encrypted; this is the one feature that needs a connection.

Install one of the apps: the web app (install it from the browser menu and let its offline-readiness check finish) or the desktop app, which bundles everything and works offline from the start. Then disconnect and work locally — creation, checking and restoration all run on the device.

Open https://app.password2qr.com on the phone. On iPhone/iPad: Safari → Share → “Add to Home Screen”. On Android: Chrome menu → “Install app”. Run the offline-readiness check inside the installed app once before relying on it offline.

Open Check Password and paste or type it. You get a local strength estimate with attack-resistance numbers and concrete improvement tips; the password never leaves the page.

Download the new installer from the Install page and run it over the old version. Verify the SHA-256 checksum listed with the release first. The app does not update itself — an offline tool should not change behind your back.

No. There is no account, login or subscription. Everything runs locally; recovery depends only on your phrase, your saved settings and your exported copies.

No. The generated password is long and complex-looking, but anyone who knows the algorithm can test likely phrases through the same derivation. Argon2id makes each guess more expensive; it cannot add unpredictability your phrase never had. Use the strength feedback and pick a phrase others cannot predict.

A compatible Password QR is encoded, not encrypted — anyone who scans it can read the password. The separate protected copy (P2QR:1) is encrypted and needs its unlock phrase. The export screen always states which one you are creating.

The source is prepared for public release, the formats are documented, and local operation needs no server. Your phrase plus the documented profile settings reproduce the password; exported files and cards remain readable by the published tools.

No. This website and the installed app restore and display or copy passwords; they cannot fill other browser tabs or native apps by themselves. Browser-extension and autofill integrations are possible later work, not current features.

No. Offline use reduces network exposure during local operations. A compromised device, browser or extension can still read secrets while you use them. Keep your device updated and use copies deliberately.

No. Future quantum computers mainly threaten certain public-key systems. For guessing a phrase, the theoretical quantum advantage does not translate into a credible attack on any current hardware, and we show no made-up countdowns. The Whitepaper explains the model and cites the primary sources.