Frequently asked questions

Short, honest answers about the most common situations with Aelyna® Keys. For step-by-step use see the User guide; for the technical details see Security.

In short, what you need to open the vault:

What do I do if I lose…

…the master password?

If you wrote it on the Emergency Kit, you will find it there.

Otherwise, unfortunately, the data cannot be recovered: not by you, not by us, not by anyone else. It is not a choice to make your life harder: it is the price of a vault that nobody but you can open. If there were a way to recover the password, it would also exist for a thief.

The only exception: if you turned on the hardware key, the recovery code opens the vault without the password and lets you choose a new one (see recovery code).

Tips to avoid getting there:

• use a phrase of 4–5 words, easier to remember than a string of symbols;
• in the first few days open the vault often, to memorise it;
• consider writing it by hand on the Emergency Kit and keeping it safe.

…the Secret Key?

On your computer you do not need to type it: it is stored in the system keychain and the app uses it on its own. It is also printed on the Emergency Kit.

You only need it on a new computer or to restore a backup elsewhere. In that case take it from the Kit.

If you have lost both the Kit and access to the computer where the vault used to open, backups with "master password + Secret Key" can no longer be opened. That is why:

• while the vault still opens, save a new Kit right away: Tools → Backup → Save the Emergency Kit (PDF)…, print it and delete the file;
• if you have a backup with a separate backup password, that one can be restored without the Secret Key (and you get a new one).

…the Emergency Kit?

If the vault still opens on this computer, you have lost nothing: save and print a new Kit from Tools → Backup → Emergency Kit.

If you think someone has found or photographed it: with the Kit and the vault file (or a backup) that person would have the Secret Key; they would still be missing the master password, unless you wrote it on the Kit. In this version the Secret Key cannot be changed from the interface yet. What you can do today:

• turn on the hardware key: from then on the Kit and the password are no longer enough, for new data;
• change your most important passwords on the websites (email, bank);
• do not leave old backups lying around.

…the hardware key?

• You have a backup key: open the vault with it, then in Settings → Hardware key press Remove next to the lost key, and register a new one as a backup.
• You have lost all keys: on the unlock screen press Lost your hardware key? Use the recovery code. After the code, choose a new master password and register a new key (or turn off the hardware key).
• You have lost all keys and the recovery code: the vault can no longer be opened, not even with the Emergency Kit. We tell you this before you turn it on for exactly that reason: always register a backup key and keep the recovery code.

Someone who finds your key on its own can do nothing: they would also need the master password, the Secret Key, the vault file and the key's PIN.

Is the key blocked after too many wrong PINs? It can only be unblocked (or reset) with the manufacturer's tool; if you reset it, it no longer works for Aelyna: use the backup key or the recovery code.

…the recovery code?

If you still have at least one registered key, create a new code from Settings → Hardware key → New recovery code…: the old one stops working. Do the same if you fear someone has seen it.

…the computer (broken, stolen, new)?

You need: a backup (.aelyna-backup), the master password and the Emergency Kit (plus the hardware key, if turned on).

1. Install Aelyna Keys on the new computer.
2. At first launch choose Restore from a backup.
3. Choose the file and type the master password and the Secret Key.

Alternatively you can copy the vault file itself (%APPDATA%\Aelyna\vaults\ on Windows, ~/Library/Application Support/Aelyna/vaults/ on Mac) and open it: the first time, the app asks for the Secret Key from the Kit.

With no backup at all and the old disk unreadable, the passwords are lost. That is why it pays to turn on automatic backups to an external drive or a cloud folder.

If the computer was stolen: whoever has it cannot open the vault without the master password (see below). To be safe, change the passwords of your most important accounts anyway.

…the backup?

If the vault still opens, create a new one right away (Tools → Backup → Create a backup) and consider automatic backups.

If you fear the backup file has fallen into the wrong hands (lost USB drive, hacked cloud account), see the next section.

Theft and infected computers

Someone stole my vault file or a backup. Can they read it?

Not without your credentials. The file is fully encrypted, titles and website names included. Opening it takes:

• the master password and the Secret Key, which is never inside the file or in backups. The Secret Key is a random number so large that trying them all is beyond the reach of any existing computer, even if your password were weak;
• or, for a backup with a separate password, that password: make it long and unique;
• in addition, if you turned it on, the hardware key.

Watch out for two cases:

• if the thief also has the Emergency Kit (with the Secret Key), the protection depends only on the strength of your master password. Aelyna makes every attempt slow and costly, but a weak password remains a risk: change your important passwords on the websites;
• copies made before turning on the hardware key open without it.

My computer is infected (virus, spyware). Does Aelyna protect me?

We answer honestly: not entirely.

• While the vault is open, malware with the right privileges can record what you type or read the app's memory. No password manager can guarantee otherwise. Aelyna limits the damage (secrets stay hidden until you show them, the clipboard clears itself, the vault locks on its own), but it cannot work miracles.
• The hardware key helps in one specific case: if the malware steals the file, the Secret Key and the password and then tries to open the copy elsewhere, it fails without the physical key. It does not protect a vault that is already open on an infected computer; and malware can ask for a touch of the key itself, hoping you give it. Touch the key only when you have just asked to unlock.

What to do if you suspect an infection:

1. Do not open the vault on that computer.
2. Clean or reinstall the system (or use another safe computer).
3. Restore from a backup, then change your important passwords on the websites, starting with your email.

Someone saw my master password while I was typing it.

On your computer that person would also need access to your account (the Secret Key is in your user's keychain); elsewhere, the Secret Key too. Change it anyway from Settings → Security and unlock → Change the master password…, then save a new Emergency Kit and make a new backup: backups made earlier with the master password still open with the old one. For more security turn on the hardware key.

The app says "Older copy of the vault" or "The hardware key is no longer required".

The file you are opening is older than the one opened last time, or no longer requires the hardware key. It happens if you put back a copy from a backup yourself, and then you can confirm. If you did not do it, someone may have replaced the file: press Cancel and restore from your most recent backup.

Sync and other devices

Can I use Aelyna Keys on several computers, or on my phone?

Automatic sync is not available yet. It is planned after version 1.0, together with the iOS and Android apps and the browser extension (see the roadmap).

Today you can:

• move the vault to another computer with a backup and the Emergency Kit;
• keep automatic backups in a folder synced to the cloud (OneDrive, iCloud Drive, Dropbox): they are encrypted.

We advise against opening the same vault file from two computers through a synced folder: changes made on one could overwrite those made on the other, and the app would report it as an "older copy".

Can I share a password with a family member?

Sharing single items will come later. Today you can hand over a backup with a separate backup password: whoever receives it does not learn your master password.

Privacy

Does Aelyna see my passwords? Where does my data go?

No. Your passwords stay encrypted on your computer and no server receives them, not even ours. There are no accounts to create.

The app goes online only to:

• check for updates (signed and verified). The request carries the app version, operating system, architecture, channel and language and, unless you turned it off, a random installation code (it identifies neither you nor the computer): it lets us count active installations. Our server does not store your IP address. You turn it off in Settings → Privacy and network, and the code is deleted from the server too;
• run the breached-password check, only if you turn it on and only when you start it. Even then no password leaves: only the first 5 characters of a fingerprint, shared by thousands of passwords.

Why does Aelyna use a "Secret Key" and not a 2FA code to open?

A 2FA code protects access to a server. The vault, instead, is a file on your computer: a 2FA code stored on the same disk would add no real protection. The Secret Key (and the hardware key) really go into computing the key that encrypts the data: without them the file cannot be decrypted.

Everyday use

Do copied passwords stay on the clipboard?

No: the clipboard clears itself after 30 seconds (from 10 to 90, in Settings), on locking and when the app closes, but only if it still holds the value copied from Aelyna. On Windows passwords do not end up in the clipboard history (Win+V) or in the synced clipboard.

Can I open the vault with my fingerprint or Windows Hello?

On Windows, yes, with quick unlock with Windows Hello (Windows fingerprint, face or PIN): turn it on from Settings → Security and unlock by confirming the master password, then on the unlock screen press Unlock with Windows Hello. It is a convenience and does not replace the master password: it is still required at the first unlock after a restart, every 14 days (from 1 to 30, in Settings) and after 5 failed attempts. It is not available with the hardware key on or in Remote Desktop. Details in the User guide.

On Mac, unlocking with Touch ID is not available yet.

A security key with a fingerprint reader (such as the YubiKey Bio) registered as a hardware key is designed to ask for the fingerprint instead of the PIN, with the check done by the key itself; testing with real keys is still in progress.

I got the password wrong too many times and have to wait.

After 5 mistakes the app waits longer and longer between attempts (from 30 seconds up to 15 minutes). Restarting the app does not reset the wait. It slows down anyone trying passwords by hand on your computer.

Can I keep the vault on a USB drive, or have more than one?

Yes. Copy the .aelyna file to the drive, then in Aelyna press Open from file… (on the unlock screen with Manage vaults, or in Settings → Vaults) and choose it: the file stays on the drive. The first time on a computer you will need the Secret Key from the Emergency Kit. You can have several vaults in the list, but only one is open at a time. Rename only changes the name shown; Remove from list does not delete the file. Lock the vault before unplugging the drive, and do not use the same vault from two different places (for example the original and a copy on the drive): changes made on one do not reach the other. See Multiple vaults.

How do I switch from another password manager?

Export from the old program to an unencrypted file, then Tools → Import and export. Chrome, Edge, Firefox, Safari, Bitwarden, 1Password, KeePass and any CSV are supported. Then delete the exported file. Details in the User guide.

I found a security problem.

Write privately to [email protected], without opening public reports. We reply within 72 hours. All the details in SECURITY.md.

Back to top