Q: How do I get started with Pwdly?

Sign up with your email , and your browser will generate a unique 3-word recovery phrase. Write it down securely - this is your key to everything. From there, you can create your first project, add credentials, and invite teammates.

Q: What encryption does Pwdly use?

All credentials are encrypted field-by-field using XChaCha20-Poly1305 (authenticated encryption) with a unique random 24-byte nonce per field. Key derivation uses Argon2id with 64 MiB of memory and 3 iterations - making brute-force attacks computationally infeasible.

Question 1

What is the 3-word recovery phrase?

Accepted Answer

When you sign up, your browser generates a random 3-word mnemonic from a curated wordlist. This phrase - combined with your email - is used to derive your Master Key via Argon2id. It is the only way to unlock your vault. It is never sent to our servers, never stored by us, and cannot be recovered if lost. Write it down and keep it somewhere safe.

Question 2

What happens if I lose my 3-word recovery phrase?

Accepted Answer

Unfortunately, your recovery phrase is the only way to decrypt your vault. Because of our zero-knowledge architecture, we have no ability to recover or reset it. If you lose your 3 words, your encrypted data is permanently inaccessible. We strongly recommend writing it down on paper and storing it securely (e.g. in a safe).

Question 3

How do I get started with Pwdly?

Accepted Answer

Sign up with your email, and your browser will generate a unique 3-word recovery phrase. Write it down securely - this is your key to everything. From there, you can create your first project, add credentials, and invite teammates.

Question 4

Can I use Pwdly on multiple devices?

Accepted Answer

Yes. Simply log in on any device and enter your 3-word recovery phrase. Your Master Key is re-derived locally on each device, and your encrypted vault is synced from the cloud. No data is ever decrypted server-side.

Question 5

What encryption does Pwdly use?

Accepted Answer

All credentials are encrypted field-by-field using XChaCha20-Poly1305 (authenticated encryption) with a unique random 24-byte nonce per field. Key derivation uses Argon2id with 64 MiB of memory and 3 iterations - making brute-force attacks computationally infeasible.

Question 6

What does 'zero-knowledge' actually mean?

Accepted Answer

It means our servers never see your passwords, your encryption keys, or your 3-word phrase. Every credential is encrypted in your browser before it leaves your device. The database stores only ciphertext - scrambled data that is completely useless without your Master Key.

Question 7

What if Pwdly's servers are hacked?

Accepted Answer

An attacker would obtain only encrypted blobs (ciphertext). Without your 3-word phrase, they cannot derive the Derived Key, cannot decrypt the Master Key blob, and therefore cannot decrypt any credentials. The Argon2id parameters (64 MiB memory, 3 iterations) make brute-forcing the key derivation extraordinarily expensive.

Question 8

Can Pwdly staff see my passwords?

Accepted Answer

No. Not engineers, not support, not anyone. The encryption keys exist only in your browser's memory while your session is active. We literally cannot decrypt your data - that's the point of zero-knowledge architecture.

Question 9

How does sharing work without sharing my 3 words?

Accepted Answer

When you invite someone to a project, a temporary 6-digit invite code is generated. This code - combined with the invitee's email - is used to derive an Invite Key via Argon2id, which wraps (encrypts) the Project Key. The invitee enters the code, their browser unwraps the Project Key, and immediately re-wraps it with their own Master Key. After acceptance, the code is useless and each user holds an independent encrypted copy of the Project Key.

Question 10

What if an invited user adds a credential, then the owner removes that user?

Accepted Answer

Any credentials the invited user added to the project remain in the project - they belong to the project, not the individual. When the user is removed, they lose access to the Project Key and can no longer decrypt any project data, including credentials they created. The remaining project members (and owner) retain full access to all credentials.

Question 11

Can I revoke access for a specific team member?

Accepted Answer

Yes. As the project owner, you can remove any member at any time. Once removed, their wrapped copy of the Project Key is deleted and they can no longer decrypt any project data. Since each member holds an independently encrypted copy, removing one user doesn't affect others.

Question 12

Is the 6-digit invite code secure?

Accepted Answer

Yes. The code is ephemeral (valid only until used or expired), bound to the invitee's specific email address, and used as input to Argon2id key derivation - not as a password itself. Even if intercepted, the code won't work for a different email. After acceptance, the pending invite is deleted and the code becomes useless.

Question 13

The 6-digit code wasn't sent in the invite email. What do I do?

Accepted Answer

After inviting a user, you're shown a 6-digit code to copy and share with them. It isn't sent by email for security reasons. If you didn't copy it, simply re-invite the user to generate a new code, then send it to them securely (e.g. via direct message) so they can complete the invite.

Question 14

Why don't you include the 6-digit invite code in the email?

Accepted Answer

The 6-digit code is intentionally not included in the email for security reasons. By sharing the code separately, we ensure that access requires two steps - the invite email and the code - reducing the risk of unauthorised access if an email account is compromised.

Question 15

What happens if you rename a custom field?

Accepted Answer

Renaming a custom field updates the field label across all credentials in that project. The underlying encrypted data is unchanged - only the display name is updated. All existing values for that field remain intact and accessible.

Question 16

What happens if you remove a custom field?

Accepted Answer

Removing a custom field will permanently delete the values stored under that field for all credentials in the project. This action cannot be undone because the encrypted data associated with that field is removed from the database. You'll be prompted to confirm before any deletion occurs.

Question 17

Can I organize credentials into folders or categories?

Accepted Answer

Pwdly organizes credentials by projects. Each project has its own encryption key and its own set of members. You can create as many projects as your plan allows - for example, one for infrastructure, one for marketing tools, one for client accounts, etc.

Question 18

Is there a limit to how many credentials I can store?

Accepted Answer

There's no hard limit on the number of credentials per project. Your plan determines how many projects and team members you can have, but within each project you can store as many credentials as you need.

Question 19

What happens to invited user(s) if payment fails on the subscription?

Accepted Answer

If a payment fails, we'll immediately send you an email informing of subscription downgrade/payment failure. At this point, all invited users will lose access to shared projects - their wrapped Project Keys are revoked. The owner's personal vault and data remain encrypted and intact. Access is restored immediately once payment is resolved - all invited users will regain access to shared projects without any data loss or changes to their vaults.

Question 20

What happens to invited user(s) if the seat count is downgraded?

Accepted Answer

If you reduce your seat count below the current number of team members, you'll be notified that some members will lose access. Removed members lose access to the Project Key and can no longer decrypt any shared credentials. Their personal vaults are unaffected. You can easily increase your seat count later, and removed members will regain access without any data loss or changes to their vaults.

Question 21

Can I switch between plans?

Accepted Answer

Yes. You can upgrade or downgrade at any time. Upgrades take effect immediately with prorated billing. Downgrades take effect at the end of your current billing cycle. Your encrypted data is never affected by plan changes.

Question 22

Do you offer refunds?

Accepted Answer

We offer a 14-day money-back guarantee on all paid plans. If Pwdly isn't the right fit, contact us within 14 days of your first payment and we'll issue a full refund.

Question 23

Can I change my email address?

Accepted Answer

Because your email is used as an input to key derivation (alongside your 3-word phrase), changing your email requires re-deriving your Master Key and re-wrapping all encrypted blobs. This process is handled automatically in Settings - you'll need to enter your 3-word phrase to confirm the change.

Question 24

How do I delete my account?

Accepted Answer

You can delete your account from Settings. This permanently removes all your encrypted data, wrapped keys, and profile information from our servers. If you're the owner of shared projects, you'll need to transfer ownership or delete those projects first. This action is irreversible.

Question 25

Can I export my data?

Accepted Answer

Yes. Pwdly supports exporting your decrypted credentials as an encrypted file or CSV. The export happens entirely in your browser - the server only provides the ciphertext, and your browser decrypts it locally before generating the export file.

Question 26

What makes Pwdly different from other password managers?

Accepted Answer

Pwdly is built specifically for teams with a zero-knowledge architecture from day one. Unlike legacy password managers that bolt on team features, Pwdly's sharing system uses cryptographic key wrapping - meaning you can share project credentials without ever exposing your personal recovery phrase or Master Key.

Question 27

What browsers and platforms are supported?

Accepted Answer

Pwdly works in all modern browsers (Chrome, Firefox, Safari, Edge) on desktop and mobile. Since all encryption happens client-side using libsodium (compiled to WebAssembly), you need a browser that supports WebAssembly - which covers 98%+ of users today.

How can we help?

Getting Started

Security & Encryption

Teams & Sharing

Projects & Credentials

Billing & Plans

Account & Settings

General