Changing Your Master Password

Overview

Your master password is the key to your encrypted vault. Change it if you think it may be known to someone else, or to move to a stronger one.

Changing it

1. In your web vault, open Settings and find the Master Password section.
2. Click Change Master Password.
3. Enter your current master password, then your new one, and confirm it.
4. Optionally set a master password hint (or tick I do not want a password hint).
5. Click Change Password.

Your new password must be at least 14 characters (the same rule as at sign-up), and it’s checked against known data breaches before it’s accepted. For help choosing one, see Choosing a Strong Master Password.

What happens when you change it

Heimlane uses zero-knowledge encryption, so changing your master password does not re-encrypt your whole vault:

1. New keys are derived from your new master password (Argon2id).
2. Your account’s encryption key - the symmetric key that actually protects your vault - is re-encrypted (“re-wrapped”) with those new keys. Your vault items themselves are not touched: they stay encrypted under the same account key.
3. The re-wrapped account key and a new authentication hash are sent to the server and sync to your other devices.

Important: Your other logged-in sessions are signed out and must sign in again with the new password.

After changing

• Sign in on your other devices with the new password.
• You can sign other sessions out yourself from Settings > Active Sessions (Revoke all other sessions).

Tips

• Never share your master password with anyone.
• Don’t store it in plain text on your device.