Help & FAQ

No. NT² is zero-knowledge by design—we never receive your password, threshold shares, or encryption keys. We cannot reset your password. If you created a threshold vault, you may set a new password with this device and your recovery kit (.nt2recovery file) via Reset password on the unlock screen. Otherwise, the only path is a .nt2backup backup exported while the vault was unlocked.

From the unlocked vault, export a .nt2backup file (Settings → backup). This encrypted bundle includes your profile, items, and attachments. Store copies in multiple safe places (encrypted drive, offline media). Test an import on another device periodically.

Export .nt2backup on the old device, transfer the file securely (USB, encrypted cloud storage you control), then import on the new device at open the vault app. You will need the same master password.

No. Sync replicates encrypted ciphertext across devices but does not replace offline backups. Keep regular .nt2backup exports as your disaster-recovery escape hatch.

Threshold vaults split your vault root across three factors: master password, this device, and a recovery kit (.nt2recovery file). Export from Settings → Recovery → Recovery kit when your vault is unlocked. Store it offline alongside your .nt2backup backup. You need two factors to unlock on a cold device—for example password + recovery kit, or this device + recovery kit.

No. Password rotation invalidates your old recovery kit. Export a new .nt2recovery file when Settings prompts you after changing your password. Old recovery kits are rejected automatically.

On the unlock screen, choose Reset password (or tap Forgot password? after a wrong password). You need this device and your .nt2recovery recovery kit file. NT² cannot reset your password for you. Without both, the only path is a .nt2backup backup made while the vault was unlocked.

Settings → Security → Biometric unlock → Revoke biometric fast unlock on all devices (master password required). This bumps a portable revocation epoch so enrolled devices stop working until you re-enroll with your password. You can also check Also revoke biometric fast unlock on all devices when disabling cloud sync.

Recovery helps you regain access to your own vault if you lose a factor—master password, this device, or your .nt2recovery recovery kit (Settings → Recovery → Recovery kit). Convenience features such as biometric fast unlock, cloud sync, and replica enroll help you use the vault day to day or move to a new device; they are not executor access and do not share your master password. Inheritance (Settings → Sharing → Legacy emergency) lets you pre-encrypt selected vault items for a designated contact with a separate legacy passphrase and optional inactivity delay—NT² cannot decrypt the package or verify legal inheritance claims. Your executor needs the .nt2legacy file and legacy passphrase you provide out of band; they do not need your master password.

No. Sync and recovery kits are for the vault owner. An executor typically does not know your master password and cannot use your device factors. Use Legacy emergency to build an encrypted package of the items you choose to hand off—not your recovery kit, master password, or live vault credentials.

No. NT² is zero-knowledge: we cannot reset your master password, open your vault, or validate wills, death certificates, or executor appointments. Legacy emergency uses an inactivity timer based on your vault unlock activity, not proof of death. NT² provides technical packaging only—not legal estate planning.

Unlimited local items, all four templates, encrypted attachments on device, .nt2backup export/import, password generator, and full offline use. See Pricing for the full comparison.

Open Settings in the vault app when billing is enabled. Checkout is handled by Lemon Squeezy; your receipt email is for billing only and is not your vault identity.

Premium uses the same Help & FAQ and email addresses as the free tier. When staff must reply by email, Premium threads are sorted ahead in our queue—we aim for 1–2 business days when volume allows. There is no live chat, phone support, or guaranteed SLA. See Contact for response expectations.

Notes apps sync to the cloud by default, appear in backups, and lack field-level encryption designed for secrets. A single device compromise or accidental share exposes the entire phrase. NT² encrypts the mnemonic before it touches disk using AES-GCM with your vault key.

No. Photos sync to iCloud/Google Photos, appear in gallery search, and survive even after you delete the image from the camera roll. Use a structured Crypto template with masked fields and copy-to-clipboard that auto-clears instead.

Your master password derives a vault key via PBKDF2 (100,000 iterations). The mnemonic is encrypted with AES-GCM and a unique IV per item. Keys stay in browser memory only while unlocked. See How it works.

Export a .nt2backup backup to encrypted storage you control. Without your master password or that backup, no one—including NT²—can recover the phrase.

No. Items and attachments are encrypted with AES-GCM in your browser before storage. Optional cloud sync transmits only ciphertext. See our Privacy policy for details.

Core Credential and Secure Note templates ship with every vault. Optional official packs in Settings add Crypto (wallets, mnemonics), Bank (accounts, routing), Document (passport, ID metadata + scans), TOTP, Insurance, Payment card, and Property fields. NT² is not a browser login autofill tool in v1.

After five minutes of inactivity—or when you close the tab—decryption keys are cleared from memory. You must enter your master password again to view sensitive fields. This protects unattended devices.

No. You can open the vault app entirely on your device without email signup. Cloud features (Premium sync) use a Vault Key DID for authentication—not your email address.

Your master password derives the encryption keys that protect every item in the vault. It is used only inside your browser and is never sent to NT² servers. Choose a strong, unique password and store it somewhere safe outside the vault.

Any modern browser with Web Crypto API support: Chrome 60+, Firefox 57+, Safari 11+, and Edge 79+. For the best offline experience, install the PWA from se.nt2.me.

Yes. After the first load, core vault operations work fully offline. Your encrypted data lives in local SQLite on device (OPFS) with attachment ciphertext in a per-vault BlobStore. Cloud sync is optional (Premium).

No. Your master password is used only inside the browser's Web Crypto API to derive encryption keys. It is never sent to NT² servers, never stored on disk, and never logged.

PBKDF2 (100,000 iterations, SHA-256) derives a vault key from your master password and a per-vault salt. Asset payloads and attachments are encrypted with AES-GCM (256-bit key, unique 12-byte IV per encryption). Keys are marked non-extractable so JavaScript cannot export them.

On your device: encrypted rows in SQLite (stored in browser OPFS at vaults/{vaultId}/vault.sqlite), attachment ciphertext in a per-vault BlobStore (OPFS attachments/*.bin), and a small device index (IndexedDB) for the vault picker. Optional Premium cloud sync (when enabled) stores ciphertext only—never your master password or plaintext items.

No—and that is intentional. Without your master password (or a valid .nt2backup backup you can unlock), the ciphertext cannot be decrypted. NT² has no back door. See Backup & recovery.

Blank notes lack structure (no masked fields, no category templates) and often sync plaintext to vendor clouds. NT² encrypts sensitive payloads before SQLite write and keeps titles optionally encrypted too.

Manually re-enter high-value items into the matching NT² template (Crypto, Bank, Document, Credential). For attachments, upload scans into Document items. Then delete the old note and empty the trash—Notes apps often keep deleted items recoverable for weeks.

No. NT² is a structured privacy vault for high-sensitivity personal assets—not a workspace, wiki, or task manager. Use it alongside your notes app for the data that would hurt most if leaked.

Yes. Export the entire vault as a .nt2backup file anytime. Your data is never locked to NT²'s servers for local-only use.

No, after the first load of se.nt2.me. Create, unlock, search, edit, attach files, and export .nt2backup backups without any network connection.

Many password managers require an account and sync metadata from the cloud; offline mode is a degraded cache. NT² stores the authoritative vault in local SQLite on device (OPFS)—no account required to start.

Offline: all local CRUD, attachments, export/import, password generator. Network (optional Premium): cross-device sync, cloud attachment storage, share relay delivery.

Yes. Add se.nt2.me to your home screen (PWA). For desktop and mobile apps, see Desktop and mobile apps.

Read across the hostname: se + nt (from NT²) → sent; 2 → to (English homophone); me → me. Together: sent to me—someone sent something for you to receive in your vault.

nt2.me is the product marketing site—landing, pricing, privacy, and help. se.nt2.me is the encrypted vault app (PWA), service worker, and canonical host for share links like https://se.nt2.me/?m=…. Splitting origins keeps SEO and storytelling separate from the app shell and deep-link policy.

User-to-user and third-party handoffs publish https://se.nt2.me/?m=<envelope> at the origin root. The m parameter carries an encrypted vault message envelope. Recipients can open the link while locked; NT² stashes the intent and routes it after unlock. See Use cases for sharing scenarios.

Yes. Any service that needs its users to receive, store, and re-share sensitive data can publish https://se.nt2.me/?m=… links. NT² does not need to host the sender's payload—the envelope travels in the URL; decryption happens in the recipient's browser after unlock.