You can't, and that is by design. Your master password is the only thing that can unlock your vault. There is no recovery email, no security questions, no support back door. By default, after ten incorrect attempts in a row the vault wipes itself - you can turn that off in Settings, but the master password is still the only way in.

The reason this trade-off exists is the same reason MSafe is interesting: there is no server to ask and no second copy of your key sitting somewhere else. If you have a backup (QR PDF, NFC tag, or .msafe file) and you remember the master password you used when you created it, you can restore from that. Otherwise the vault is lost.

Only from a backup you created earlier. The wipe is on by default and is intentional and irreversible - the encrypted vault is deleted from your device. If you have a QR-PDF backup, an NFC tag backup, or an exported .msafe file, you can restore from those. If not, set a fresh master password and start a new vault. You can disable the auto-wipe in Settings if you would rather the app never deletes the vault on failed attempts.

Open Settings inside MSafe and pick the export format that suits you:

• QR-code PDF - generates a printable PDF of encrypted QR codes (one per credential, plus a full-vault page). Print it and lock it in a drawer.
• Encrypted .msafe file - exports the whole vault as a single encrypted file you can move between devices.
• NFC tag - write a single credential to a writable NFC tag from the credential's detail screen.

All three formats are encrypted the same way as your live vault, so anyone who finds them still needs your master password to read them.

Install MSafe on the new device. On first launch, set the same master password you were using before. Then import from your backup:

• From an encrypted file: Settings > Import vault > pick the .msafe file
• From a printed QR PDF: open MSafe, scan each credential's QR code with the camera
• From an NFC tag: tap the tag against the back of your phone with MSafe open

As long as you use the same master password, a backup restores on any MSafe install - the free app, the pro app, a fresh install on a different phone, or across platforms (an export from Android imports on iPhone and vice versa). The encrypted format is identical everywhere.

Open a saved credential, tap Add authenticator, and scan the setup QR code shown by the service when you enable two-step verification. You can also enter its setup key or otpauth://totp link. Save the credential to your device, then use the displayed code to finish setup with the service.

The code updates automatically and shows how much time is left. Tap its copy button to copy the current code. A plain setup key uses six digits and a 30-second interval; setup links and QR codes can specify another supported algorithm, eight digits, or a different interval. Codes work offline. If the service rejects them, check that your phone's date and time are correct.

The authenticator is included in encrypted file, QR, and NFC backups. Android 4.88 and later preserve it. iOS and older Android versions do not preserve authenticator data after import and re-export, so keep your original Android backup. Counter-based HOTP codes and authenticator migration QR codes are not supported.

A passkey is a way to sign in without typing a password. The website keeps a lock and MSafe keeps the only key that opens it, so there is nothing to remember, type, or steal from the website.

Passkeys need Android 14 or later, or iOS 17 or later. On Android, open Settings > Autofill > Passkeys and passwords in MSafe and turn on MSafe in the system page that opens. You can also find it in the Android Settings app under Passwords, passkeys & accounts. On iPhone, turn on MSafe in Settings > General > AutoFill & Passwords, the same setting that fills passwords.

When a website or app offers to create a passkey, choose MSafe as the place to save it. If MSafe already has a login for that site and username, the passkey is added to it; otherwise MSafe creates a new entry. To sign in, pick the passkey from the list Android shows. MSafe asks for your biometric or master password every time.

Passkeys are included in encrypted file, QR, and NFC backups, and a passkey made on Android works on iPhone and the other way round. Older MSafe versions without passkey support do not keep them after import and re-export, so keep your original backup. Removing a passkey in MSafe does not remove it from your account on the website, so remove it there too.

You are done. On Android, a check mark next to Passkeys and passwords in MSafe's settings means the phone now offers MSafe whenever a website or app asks for a passkey or a password. There is nothing to set up for each app or website.

MSafe cannot use passkeys you already made in another app, such as Samsung Pass or Google Password Manager. Those apps keep their passkeys to themselves. To move a website over to MSafe, sign in as usual, open the website's security or passkey settings, add a new passkey, and choose MSafe when your phone asks where to save it. Your old passkey keeps working until you remove it from the website.

If your phone keeps suggesting another app first, tap to see more options and pick MSafe. To use only MSafe, turn the other app off in the Android Settings app under Passwords, passkeys & accounts.

On Android, the free version stores up to 10 credentials and the pro version removes the cap. That is the only difference. Both ship with the same encryption, backup options, autofill, and privacy guarantees, no ads, and no trial nags. Pro is a one-time Google Play purchase - no subscription.

On iPhone, there is just one paid MSafe app with no credential cap and no free tier - a single one-time App Store purchase, no subscription or in-app purchase.

The free and pro apps are separate Android apps, so they have separate vaults. To migrate:

1. In free MSafe: Settings > export your vault as an encrypted .msafe file
2. Install MSafe Pro from Google Play
3. On first launch, set the same master password you used in free
4. Settings > Import vault > pick the .msafe file you exported
5. Verify everything imported, then uninstall the free version

On Android, open the Settings app, search for Autofill service (sometimes under Passwords & Accounts or System), and pick MSafe as your autofill provider. On iPhone, open Settings > General > AutoFill & Passwords and enable MSafe as a password provider. Once set, fields in apps and browsers that ask for credentials will let you fill from your MSafe vault. You'll be prompted for biometric or master password to unlock the vault on each fill.

Open MSafe, go to Settings, and toggle on Biometric login. The app will ask for your master password once to set it up, then for your biometric from then on - your fingerprint on Android, or Face ID / Touch ID on iPhone. Your master password always works as a fallback.

On Android 11 and later you can also turn on Allow screen lock, just below it. The unlock prompt then offers your phone's PIN, pattern or password as well as your fingerprint. It is handy when your fingerprint doesn't read, but anyone who knows your phone's PIN can then open MSafe, so it is off by default.

By design. MSafe makes no network connections - on Android it isn't granted internet permission, and on iPhone it ships with no networking code - so it can't send your vault anywhere. To move data between devices (including between an Android phone and an iPhone), use the export/import flow with an encrypted .msafe file, a QR PDF, or an NFC tag. You decide where the backup goes and when it's transferred.

MSafe requires Android 8.0 or later, or iOS 15 or later. Optional features need the matching hardware: NFC (for tag backups; more limited on iPhone), camera (for QR scanning), and a fingerprint / Face ID sensor (for biometric unlock). Passkeys need Android 14 or iOS 17 or later.

On your device, encrypted, inside MSafe's private storage. Cloud backup is kept off - Android's auto-backup to Google is disabled, and on iPhone the vault is stored where it won't sync to iCloud - and nothing is sent to any server. See the privacy policy for full details.