iOS app is in testing phase. Please help by testing via TestFlight 🙏🏻 Join the beta here
2Secret
Donate Download
Download Donate View on GitHub

Help

Getting started with 2Secret.

From your first vault to sharing with your family: short, practical guides for every step.

Step 1

Create your account.

Decide first where your vault lives: only on this device, or on your own server so you can sync and share.

  1. Install and open 2Secret

    Download the app for your device. On macOS and Windows you may see a warning the first time; the download page explains what to do.

  2. Create a new account

    Enter your name and e-mail address. To sync, switch on Sync with a 2Secret server and enter its address, for example https://vault.example.org, plus the invite code if your server uses one. Leave it off for a vault on this device only.

  3. Choose your master password

    At least 12 characters with a “good” rating. Make it something you’ve never used before: a few random words work well.

Step 2

Save your Emergency Kit.

Right after you create your account, 2Secret shows your Secret Key and offers your Emergency Kit to download: a printable sheet with your sign-in details and Secret Key. Print it or save it, then keep it somewhere safe and offline. You need it to sign in on a new device, and nobody, including us, can recover it for you.

Why the Secret Key matters

Step 3

Sign in on a second device.

This needs a vault on your own server.

  1. Install 2Secret on the new device

    Choose Sign in to an existing account.

  2. Enter your details

    Your server address, e-mail address, Secret Key (from your Emergency Kit) and master password.

  3. Wait for the first sync

    Your vaults download in encrypted form and are decrypted on the device. From then on, the device keeps working offline and syncs when it can.

Step 4

Import your passwords.

Export from your current password manager or browser, then choose Settings → Import in 2Secret. The format is detected automatically, or you can pick it yourself.

Export files are not encrypted. Delete them, and empty your trash, as soon as the import is done.

  1. From Bitwarden

    In the Bitwarden web vault, go to Tools → Export vault and choose an unencrypted format (JSON or CSV). Import that file in 2Secret. Choose JSON to bring your passkeys along.

  2. From LastPass

    In LastPass, open Advanced options → Export (or Account options → Advanced → Export in the extension) and save the CSV file. Import it in 2Secret.

  3. From Chrome, Edge, Brave, Firefox or Safari

    • Chrome: Google Password Manager → Settings → Export passwords.
    • Edge: Settings → Passwords → Export passwords.
    • Firefox: open about:logins, then the ••• menu → Export passwords.
    • Safari: in the Passwords app (or Safari on older macOS), File → Export All Passwords.

    Each produces a CSV file to import in 2Secret.

  4. From KeePass or KeePassXC

    In KeePass 2, export your database as KeePass XML (2.x). In KeePassXC, choose Database → Export → CSV File. Import the file in 2Secret.

  5. From Dashlane

    In Dashlane, go to Settings → Export data and download your data as CSV. Import the CSV file in 2Secret.

  6. From another password manager

    Export your passwords as a CSV file with column names in the first row. 2Secret recognises the usual names, such as name or title, url or website, username, password, notes and totp. Import the CSV file in 2Secret.

Browser extension

Install and use the browser extension.

  1. Install it

    Use the store link on the download page when it’s available. Until then, load the extension from the release zip:

    • Chrome, Edge and Brave: unzip 2secret-extension-v….zip, open chrome://extensions, edge://extensions or brave://extensions, switch on Developer mode, choose Load unpacked and select the folder.
    • Firefox: open about:debugging, choose This Firefox → Load Temporary Add-on and select the manifest.json. Firefox removes it again when it restarts. Passkeys need Firefox 128 or newer.

  2. Sign in

    Sign in with your server address, e-mail address, Secret Key and master password.

  3. Fill a login

    On a sign-in page, open the extension and click Fill next to the matching item. It fills only when you click, and only if the site really matches.

  4. Use passkeys

    When a website wants to create or use a passkey, 2Secret opens its own window: save or use the passkey, or choose another device or security key. Settings → Passkeys in this browser turns this off.

The CLI

Use 2Secret from the terminal.

Download the 2secret archive for your system from the download page, check its SHA-256 checksum, unpack it and put 2secret somewhere in your PATH. Sign in once with 2secret account signin --server … --email …, then unlock your shell with eval "$(2secret unlock)"; it stays unlocked for 30 idle minutes. 2secret --help lists every command.

References use the form 2s://Vault/Item/field. The full guide is in the CLI documentation.

Read a single field

bash
2secret read 2s://Work/Database/password

Run a command with secrets

bash
export DATABASE_PASSWORD=2s://Work/Database/password
2secret run -- npm run deploy

Fill a template

bash
2secret inject -i config.tpl.yml -o config.yml

All commands

bash
2secret --help

Sharing

Share a vault and compare fingerprints.

Sharing needs your own server; the person you share with needs an account on it.

  1. Share the vault

    Open the vault you want to share, choose Share, enter the other person’s e-mail address and pick a role: Can view, Can edit or Can manage.

  2. Compare fingerprints

    The member list shows each person’s fingerprint, such as 3F9A-77C1-0B2E-91D4. The other person finds their own under Settings → Public key fingerprint. Compare them in person or over a call. If they match, you’re sharing with the right person and nobody swapped in a different key.

  3. Done

    After their next sync the vault appears on their devices. You can change roles or stop sharing at any time; removing someone gives the vault a new key.

Emergency access

Give someone access for when you can’t.

Your emergency contact needs a 2Secret account on the same server, version 1.9 or newer. They can only read the vaults you own.

  1. Add a contact

    Go to Settings → Emergency access, choose Add, enter their e-mail address and choose a waiting period. Then compare the fingerprint 2Secret shows with them, as when you share a vault.

  2. They ask for access

    Under People who trust you, your contact chooses Ask for access. Your apps show the request: Approve gives access at once, Deny stops it. If you do neither, they get access when the waiting period is over.

  3. They open your vaults

    With access, your contact chooses Open vaults: your vaults appear in their list, read-only. End access in your settings takes them out again and gives your vaults new keys.

On the desktop

Quick Access, SSH keys and QR codes.

In the apps for macOS, Windows and Linux. You turn these on or off under Settings → Desktop app.

  1. Find a password with Quick Access

    Press Ctrl+Shift+Space (⇧⌘Space on the Mac) anywhere and type. Enter copies the password, Shift+Enter the user name, Ctrl/⌘+Enter the one-time code, and Alt/⌥+Enter shows the item in 2Secret. Under Wayland, set a shortcut in your desktop’s keyboard settings that runs 2-secret --quick-access.

  2. Start at login

    Turn on Start at login and 2Secret starts in the menu bar or system tray when you log in, without its window. When you close the window, it keeps running there.

  3. Use your SSH keys

    Turn on SSH agent. On macOS and Linux, add the IdentityAgent line 2Secret shows to ~/.ssh/config; on Windows, ssh and git use it right away (stop the OpenSSH Authentication Agent service if it runs). 2Secret asks before a key is used, naming the program and the key; you can allow a key until 2Secret locks.

  4. Scan a QR code from the screen

    When a website shows a QR code for two-step verification, choose Scan QR code in the item editor. 2Secret adds the one-time password, and for a new item also its title and user name. macOS asks once for permission to record the screen.

Watchtower

Fix what Watchtower finds.

Open Watchtower to see weak, reused and old passwords, http websites and expiring cards and documents; click a finding to open the item. Start with reused passwords on important accounts: change them one by one, and let the generator create the new ones. Want to know whether a password appeared in a known data breach? Choose Check now under Check for data breaches; it uses Have I Been Pwned with k-anonymity, so only the first 5 characters of a hash leave your device, never a password.

Still stuck? We’re happy to help.

Read the FAQ Contact us