Help & FAQ

No. NT² is zero-knowledge by design—we never receive your master password or encryption keys and cannot decrypt your vault. There is no "forgot password" flow. If you lose the password, the only recovery path is a backup you made while the vault was unlocked.

From the unlocked vault, export a .nt2vault file (Settings → backup). This encrypted bundle includes your profile, items, and attachments. Store copies in multiple safe places (encrypted drive, offline media). Test an import on another device periodically.

Export .nt2vault on the old device, transfer the file securely (USB, encrypted cloud storage you control), then import on the new device at unlock your vault. You will need the same master password.

No. Sync replicates encrypted ciphertext across devices but does not replace offline backups. Keep regular .nt2vault exports as your disaster-recovery escape hatch.

Unlimited local items, all four templates, encrypted attachments on device, .nt2vault export/import, password generator, and full offline use. See Pricing for the full comparison.

Open Settings in the vault app when billing is enabled. Checkout is handled by Lemon Squeezy; your receipt email is for billing only and is not your vault identity.

Notes apps sync to the cloud by default, appear in backups, and lack field-level encryption designed for secrets. A single device compromise or accidental share exposes the entire phrase. NT² encrypts the mnemonic before it touches disk using AES-GCM with your vault key.

No. Photos sync to iCloud/Google Photos, appear in gallery search, and survive even after you delete the image from the camera roll. Use a structured Crypto template with masked fields and copy-to-clipboard that auto-clears instead.

Your master password derives a vault key via PBKDF2 (100,000 iterations). The mnemonic is encrypted with AES-GCM and a unique IV per item. Keys stay in browser memory only while unlocked. See How it works.

Export a .nt2vault backup to encrypted storage you control. Without your master password or that backup, no one—including NT²—can recover the phrase.

No. Items and attachments are encrypted with AES-GCM in your browser before storage. Optional cloud sync transmits only ciphertext. See our Privacy policy for details.

Four structured templates: Crypto (wallets, mnemonics), Bank (accounts, routing), Document (passport, ID metadata + scans), and Credential (passwords, API keys). NT² is not a browser login autofill tool in v1.

After five minutes of inactivity—or when you close the tab—decryption keys are cleared from memory. You must enter your master password again to view sensitive fields. This protects unattended devices.

No. You can create a vault entirely on your device without email signup. Cloud features (Premium sync) use a Vault Key DID for authentication—not your email address.

Your master password derives the encryption keys that protect every item in the vault. It is used only inside your browser and is never sent to NT² servers. Choose a strong, unique password and store it somewhere safe outside the vault.

Any modern browser with Web Crypto API support: Chrome 60+, Firefox 57+, Safari 11+, and Edge 79+. For the best offline experience, install the PWA from se.nt2.me.

Yes. After the first load, core vault operations work fully offline. Your encrypted data lives in local SQLite and IndexedDB on your device. Cloud sync is optional (Premium).

No. Your master password is used only inside the browser's Web Crypto API to derive encryption keys. It is never sent to NT² servers, never stored on disk, and never logged.

PBKDF2 (100,000 iterations, SHA-256) derives a vault key from your master password and a per-vault salt. Asset payloads and attachments are encrypted with AES-GCM (256-bit key, unique 12-byte IV per encryption). Keys are marked non-extractable so JavaScript cannot export them.

On your device: encrypted rows in SQLite (via wa-sqlite → IndexedDB), attachment ciphertext in a per-vault BlobStore, and a small device index for the vault picker. Optional Premium cloud sync (when enabled) stores ciphertext only—never your master password or plaintext items.

No—and that is intentional. Without your master password (or a valid .nt2vault backup you can unlock), the ciphertext cannot be decrypted. NT² has no back door. See Backup & recovery.

Blank notes lack structure (no masked fields, no category templates) and often sync plaintext to vendor clouds. NT² encrypts sensitive payloads before SQLite write and keeps titles optionally encrypted too.

Manually re-enter high-value items into the matching NT² template (Crypto, Bank, Document, Credential). For attachments, upload scans into Document items. Then delete the old note and empty the trash—Notes apps often keep deleted items recoverable for weeks.

No. NT² is a structured privacy vault for high-sensitivity personal assets—not a workspace, wiki, or task manager. Use it alongside your notes app for the data that would hurt most if leaked.

Yes. Export the entire vault as a .nt2vault file anytime. Your data is never locked to NT²'s servers for local-only use.

No, after the first load of se.nt2.me. Create, unlock, search, edit, attach files, and export .nt2vault backups without any network connection.

Many password managers require an account and sync metadata from the cloud; offline mode is a degraded cache. NT² stores the authoritative vault in local SQLite + IndexedDB on your device—no account required to start.

Offline: all local CRUD, attachments, export/import, password generator. Network (optional Premium): cross-device sync, cloud attachment storage, share relay delivery.

Yes. Add se.nt2.me to your home screen (PWA). Native iOS, Android, and desktop shells are on the roadmap with the same vault model.