Security Essentials

A checklist of the most important habits that keep your vault safe and recoverable.

Do's

• Use a strong master password - at least 12 characters mixing letters, numbers, and symbols, or a multi-word passphrase. This is the only password that protects everything in your vault.
• Create a Recovery Key and store it safely - generate your Recovery Key immediately after sign-up, download the PDF, and keep it somewhere secure off your device (a USB drive, a printed copy in a safe). Without it, a forgotten master password means permanent loss of access.
• Enable biometric unlock on supported devices - Face ID, Touch ID, or Windows Hello let you unlock instantly without typing your master password each time, while keeping security intact.
• Take regular local backups - schedule a backup at least once a week and export the file to a location outside the app (a separate drive, another device). A backup left only on the same device disappears with it.
• Set up Local Sync across multiple devices - pairing even one extra device (e.g. phone and laptop) means two independent encrypted copies of your vault. If one device is lost or fails, the other still has everything.
• Choose an Auto Lock time that fits how you use the app - if you use LockYit on a shared or frequently left-unattended device, keep it at 1-5 minutes. On a personal device you always carry, a slightly longer window still beats "Never".

0 / 6 done

Don'ts

• Don't reuse your master password - it should be unique to LockYit. Using a password you already use elsewhere means a breach on another site can unlock your vault.
• Don't skip saving your Recovery Key - generating the key is not enough; you must complete all the steps including tapping Save Recovery Key in Account. Skipping this means you cannot recover your account if you forget your master password.
• Don't store your Recovery Key only on the same device as LockYit - if that device is lost, stolen, or wiped, you lose both the vault and the key needed to get back in.
• Don't rely on a single device with no backup - LockYit stores data locally. There is no cloud copy. If you have one device and no backup, a reset or failure means your vault is gone permanently.
• Don't leave Auto Lock set to "Never" - an unlocked vault on an unattended device gives anyone with physical access full visibility into all your passwords and secure notes.
• Don't share your master password - to give someone access to a specific item, use Local Sharing instead. It re-encrypts just that item for the recipient and keeps your master password entirely private.

0 / 6 done

Start here if you're new

If you've just created your account, work through the Quick Start Guide first - it walks you through creating a Recovery Key, enabling biometrics, and adding your first item. Come back here to make sure all the boxes above are ticked before you rely on LockYit day-to-day.