Frequently asked questions

What is QubKey and how does it work?

QubKey is a local-first, open-source password manager. Your secrets are stored in encrypted .rkvey vault files on your device. The desktop app (Rust + Tauri + React) encrypts and decrypts data using your master password. QubKey does not store your master password and cannot access your vault without it. You can search, organize, and manage 20 entry types, generate passwords, use TOTP, and optionally sync between your own devices.

What platforms are supported?

The QubKey 1.0.2 desktop app is available for macOS (Apple Silicon, DMG installer) and Windows 10/11 (NSIS and MSI installers, x64 and x86). Linux is in active development. The app is built with Tauri for native multi-platform performance, with system-specific integrations: Keychain on macOS and Credential Manager on Windows. Browser extensions are available for Chrome and Firefox on macOS and Windows. Each platform has its own extension package — macOS and Windows builds are not interchangeable.

Is my data stored in the cloud?

By default, no. QubKey is local-first: all your data stays on your device in encrypted .rkvey files. You keep full control — you can back up, move, or copy your vault files without depending on a cloud service. Optional cloud sync between your own devices may be enabled if you choose; it remains user-controlled and does not change the local-first design of the application.

How does encryption work?

QubKey uses authenticated encryption (AEAD). AES-256-GCM is the default algorithm, with XChaCha20-Poly1305 available as an alternative. Your master password is processed through Argon2id, a memory-hard key derivation function that resists brute-force attacks. Each entry is encrypted with a unique nonce. When the vault is locked or after use, sensitive data is erased from memory (zeroization). Auto-lock further protects your vault after a period of inactivity.

Is the .rkvey format secure?

Yes. The .rkvey v4 format is QubKey's encrypted vault file format. It carries a cryptographic RKVE signature for identification, an encrypted index for fast search without decrypting entry content, a Write-Ahead Log (WAL) for crash recovery, and encrypted storage for history, sharing metadata, and statistics. The entire file remains encrypted under your master password.

How does the QubKey browser extension work?

The Chrome and Firefox extensions connect to the QubKey desktop app through Native Messaging — a secure local channel on your computer. The extension does not store your vault and does not send credentials to the cloud. When your vault is unlocked in the desktop app, the extension can autofill login forms and stay synchronized in real time. Each OS has its own extension package — macOS and Windows builds are not interchangeable.

How do I set up the browser extension?

To use the extension: (1) install the QubKey desktop app for your operating system, (2) unlock your vault, (3) install the matching browser extension (Chrome or Firefox), and (4) configure Native Messaging so the extension can communicate with the desktop app. Extension packages are platform-specific — use the macOS build on Mac and the Windows build on Windows. Full step-by-step instructions are available on the browser extensions page at /browser-extensions.

Is QubKey open-source?

Yes. QubKey is released under the MIT license. The source code (Rust backend, Tauri bridge, React + TypeScript interface) is publicly available and can be audited by anyone. Standard cryptographic algorithms are used throughout, and the .rkvey format is documented for transparency.

Is QubKey free?

Yes. QubKey is free and open-source under the MIT license. You can use, modify, and distribute it without restrictions. The source code is accessible for audit and community contribution.

Can I import my passwords from another manager?

Yes. QubKey supports import from standard formats: CSV, JSON, XML, and HTML — compatible with exports from KeePass, Bitwarden, and 1Password. You can preview data before importing, and choose to add new entries or replace the entire vault. Templates are available to simplify migration.

What entry types are supported?

QubKey supports 20 entry types in six categories: passwords and keys (Password, SSHKey, PGPKey, TokenLogin, Passkey, RecoveryCodes), financial (CreditCard, BankAccount, CryptoWallet), identity (NationalID, Passport, DriverLicense, HealthID, Profile, ContactAddress), notes (Note, RecoveryPhrase, ConfigSnippet), documents (Document), and device access (WiFi). Each type has dedicated fields.

How does two-factor authentication (2FA/TOTP) work?

QubKey includes a TOTP code generator compliant with RFC 6238. Add a TOTP secret to a Password entry via QR code scan or manual entry. The generator supports SHA1, SHA256, and SHA512, with 6- or 8-digit codes and configurable periods (default 30 seconds). Codes display with a visual timer and can be copied with automatic clipboard erasure. TOTP secrets are stored encrypted in the vault.

What is the security dashboard and how to use it?

The security dashboard gives you an overview of your vault's health. It shows a global security score (0–100) based on password strength, reuse, age, and 2FA coverage. Real-time metrics include reuse rate, average strength, and actionable recommendations. Click any recommendation to jump to the relevant entries for review.

How does history and versioning work?

QubKey records every change to your entries. Each create, update, delete, or restore creates an encrypted snapshot. Browse versions on an interactive timeline, compare two versions side by side, and restore a previous state if needed — restoration itself is recorded as a new version.

Can I share entries securely?

Yes. From a vault entry you can create a temporary encrypted link (duration, max views, optional password) or send the entry to another QubKey account. Peer shares use X25519 key exchange and AES-256-GCM; recipients accept or dismiss in their inbox. You choose granted rights (read, modify, duplicate, temporary link, forward) and can revoke access. Optional attachments stay encrypted end to end.

How does the password generator work?

Configure password length and character sets (lowercase, uppercase, numbers, symbols). A strength indicator shows a score, entropy estimate, and improvement tips. You can also generate memorable passphrases from secure wordlists or create PINs. Generated values can be copied with automatic clipboard erasure after a configurable timeout.

What happens if I forget my master password?

Your master password derives the vault decryption key. If you forget it, your data cannot be recovered — by design, QubKey has no backdoor. Protect yourself by choosing a strong memorable password, storing a backup in a safe place, and keeping regular backups of your .rkvey files. Test your backups periodically to confirm they open correctly.

How does auto-lock and secure clipboard work?

Auto-lock secures your vault after a configurable inactivity period (default 5 minutes). On lock, all sensitive data is erased from memory (zeroization). You can also lock manually at any time. The secure clipboard clears copied passwords or TOTP codes automatically after a configurable timeout, even if the app is closed.