Security, in plain language
Notes from building a zero-knowledge password vault and an authenticator: the decisions behind them, the trade-offs we took, and the parts we would rather you heard from us than found out later.
Every factual claim about another product links to that vendor’s own page, with the date we last read it.
- How-to 9 min read
Transfer authenticator to new phone: every app, iPhone or Android
Which method fits your app, how to go between iPhone and Android, and what honestly helps when the old phone is already lost or broken.
Read - Explainer 10 min read
What is a password manager, how does it work, and is it safe?
What a password manager does, how the encryption keeps your passwords from the company that stores them, what can still go wrong, and a short checklist for choosing one.
Read - Explainer 10 min read
How do authenticator apps work? TOTP codes, push approvals and passkeys
What actually happens inside an authenticator app: the shared secret and the clock behind every six-digit code, how a push approval reaches your phone, what a passkey does differently, and why the app beats a text message.
Read - Explainer 9 min read
2FA vs MFA: what is the difference, and which methods are most secure?
Two-factor and multi-factor authentication, side by side: what each term means, where two-step verification fits, real examples, and every common method ranked from weakest to strongest.
Read - Explainer 8 min read
What is FIDO2? FIDO, WebAuthn, CTAP and passkeys explained
FIDO2 is the open standard behind passkeys and security keys. What FIDO stands for, how WebAuthn and CTAP fit together, how it differs from U2F, and why it is the one kind of sign-in that resists phishing.
Read - Explainer 8 min read
Passwordless login: how it works, the methods, and which is safest
Signing in without a password, method by method: passkeys, magic links, one-time codes and push-only approval, what each one really relies on, and how a website can offer it.
Read - How-to 9 min read
How to set up GitHub 2FA with an authenticator app
Step by step: turn on two-factor authentication for GitHub with any authenticator app, keep your recovery codes safe, move it to a new phone, and what to do when the codes do not work or the phone is gone.
Read - Explainer 9 min read
Password manager vs authenticator app: what is the difference, and do you need both?
One remembers what you know, the other proves what you have. What each app does, why most people are better off with both, and where Microsoft Authenticator, Google Password Manager and the all-in-one apps fit.
Read - Explainer 12 min read
What is 2FA, and what is an authenticator app?
Two-factor authentication in plain language: the factors, the kinds of second factor and how safe each one is, how an authenticator app makes its codes, and how to set one up without locking yourself out.
Read - Guide 7 min read
Authenticator app for PC and Mac: your options, and the trade-off
The big authenticator apps are phone-only. Here is what does run on a Windows PC or a Mac, and why your phone should stay the main device.
Read - How-to 10 min read
How to export your passwords from Chrome, and import them
The exact steps on a computer, Android and iPhone, how to import a CSV back into Chrome, and what to do with the file afterwards.
Read - How-to 10 min read
Google Authenticator backup, and how to back up any authenticator app
Turn on the backup your app already has, save every site’s recovery codes, and know what to do if the phone is already gone.
Read - How-to 8 min read
How to set up SSH 2FA on a Raspberry Pi
Require your SSH key and a tap on your phone to log in to a Raspberry Pi, with offline codes for when the network is down and a way back in if something goes wrong.
Read - How-to 8 min read
How to set up SSH 2FA on Debian 12 and 13
Require an SSH key and a tap on your phone to log in to a Debian server, with offline codes, a sign-in log and a way back in if something goes wrong.
Read - How-to 8 min read
How to transfer Authy to a new phone
Turn on Backups, add the new phone with Multi-device, and enter your backups password. Plus what to do with a new number, a lost phone or a forgotten password.
Read - How-to 8 min read
How to transfer Microsoft Authenticator to a new phone
Turn on backup, restore on the new phone, and sign in again to work accounts. Plus what to do when the backup cannot cross between iPhone and Android.
Read - How-to 8 min read
How to transfer Google Authenticator to a new phone
Three ways to move your 2FA codes, depending on whether you still have the old phone and whether your codes were synced, and how to make the next move painless.
Read - Migration 6 min read
What happens to your 2FA codes when you switch vaults
Exporting a vault usually exports your two-factor secrets too, in plain text, in the same file as the passwords. Here is what our importer does with them instead, and why.
Read - Plain language 7 min read
What “zero-knowledge” actually means — and how to check it
The phrase is on every vendor’s homepage, ours included. It has a precise meaning, a set of things it does not cover, and four checks you can run without trusting anybody.
Read - Two factors 8 min read
Should your password manager store your 2FA codes?
Every major vault will keep a TOTP secret in the same record as the password it protects. That is genuinely convenient, and it quietly collapses two factors into one.
Read
Try the products the posts are about
A zero-knowledge vault with a free plan, and an authenticator whose codes are free and unlimited.