Frequently asked
questions.

PassGram is a private place for your digital life. It combines secure messaging, an encrypted vault for sensitive information, and strong account protection in one app that works on your phone, on the web and on desktop.

The idea is simple: your conversations and your private information should be as easy to use as any modern app, but built so that you stay in control. Everything is designed around approvals that appear on your own device.

Open web.zpas.org/login and sign in with the same PassGram account you use in the app. You can type your username and password, or choose the QR code option and approve it with your phone.

If you open the link on a smartphone that has the app installed, PassGram opens the app instead of the website, because you already have everything you need there.

PassGram is available for Android, for Windows and as a web app that runs in any modern browser. Your account is the same everywhere, so you can start on your phone and continue on your computer.

The Apps page lists current downloads. We recommend installing only from official links on this website so that you never end up with a fake copy.

Accounts are created in the PassGram app. This is on purpose: your phone is the trusted device that approves new sign-ins later, so it should be the place where your account begins.

After you have created the account on your phone, you can use the same details on the web and on desktop.

Yes, there is a free plan that covers everyday use. Paid plans, called Plus and Pro, unlock higher limits and extra features. You will always see what a plan includes before you pay, and you can cancel at any time.

On the web login page you choose the QR option and a code appears on the screen. You open PassGram on your phone, scan the code and check the device name, the location and the time. If everything looks right, you approve, and the web page signs in immediately.

The QR code is valid for ten minutes and can be approved by one device only. It never contains your password or any key, so a photo of it cannot be used to break into your account after it expires.

This message means that the code is either older than ten minutes or has already been approved once. This is a safety feature: a code that has been used can never be used again.

Simply refresh the web page to create a new QR code and scan the new one. Do not scan an old screenshot or a code someone else sent you. If the problem continues, check that your phone has an internet connection and that the date and time on both devices are set automatically.

Text messages are the weakest link in many accounts. Attackers can redirect a phone number to a SIM card they control, or read messages on a stolen number. A code delivered inside your signed-in PassGram app can only be seen by someone who already holds your trusted device.

The six-digit code appears in a protected message from the PassGram security account. It expires quickly, can be used once and is limited to a few attempts.

Whenever your account is used on a new device you receive a notice that states your username, the date and time in UTC, the device name and the approximate location. It also explains how to end the session if it was not you.

This message comes from a system account that no one can reply to or imitate, so you can trust it more than any email or text that claims to be from us.

Do not enter it and do not tell it to anyone. A code you did not ask for means that someone knows your username and is trying to sign in. Open Settings → Devices, end any session you do not recognise, and change your password. If you can, turn on two-step verification as well.

First make sure that the app is open and online, and that notifications are allowed for PassGram in your phone settings. Then request a new code; the old one stops working as soon as a new one is created.

If you are signing in on a new phone and your old phone is not available, use your recovery key as described in the security guide, or contact us on X for help with your identity.

No. Content in your vault is encrypted on your device before it is uploaded, using keys that come from secrets only you control. Our servers store encrypted data that we are unable to read, which also means we are unable to reveal it to anyone else.

The trade-off is important to understand: because we cannot read it, we also cannot recover it if you lose both your master password and your recovery key. Keep your recovery key safe.

The recovery key is a long secret that lets you regain access if you forget your master password. Write it down or print it and keep it offline, for example with important documents. Do not store it as a screenshot, in an email or in a notes app that syncs to the cloud.

We will never ask for your recovery key. If a message asks for it, it is a scam.

Open Settings → Devices. Each session shows the device name, the approximate location and the time of last activity. Tap a session to end it; that device is signed out immediately and its token stops working.

No. We do not sell personal information, we do not show advertising and we do not use advertising trackers on the website. You can read the details in the Privacy Policy.

Sign in to PassGram on another device and open Settings → Devices. End the session on the lost phone, then change your master password. Also use your phone maker’s “find my device” tool to lock or erase it. Because your vault is encrypted and your phone should have a screen lock, a thief cannot simply read it, but acting quickly is always best.

PassGram never asks for your master password, recovery key or one-time codes, and it never threatens to close your account in 24 hours. Be careful with messages that create urgency, with links that do not end in passgram.web.app or web.zpas.org, and with anyone who asks you to read out a code.

When in doubt, close the message and open the app yourself.

Please tell us privately before you share it publicly. Message @4rezan on X and ask for a private channel, or use Settings → Support in the app. Describe what you found, how to reproduce it and what you think the impact is. The Security page explains the rules for good-faith research.

Yes. You can be signed in on your phone, in a browser and on a computer simultaneously. Every device is listed under Settings → Devices, and you can end any of them at any time.

If you already have the app, it is faster and more secure to use it than to use the website in a browser. When you tap Open on a phone, PassGram sends you straight to the app. If it is not installed, you are taken to the download page.

Yes. PassGram uses your username and your trusted devices rather than your phone number, and sign-in codes are delivered in the app, not by SMS.

You decide what others can see in your privacy settings. Private content that is encrypted can only be opened by the people it is meant for. The security notices in your inbox are visible only to you.

It is a read-only system account. This is intentional: it keeps the channel clean and impossible to imitate. You can mute or unmute it from its profile, but nobody can send messages as it or to it.

Free covers everyday secure messaging and storage. Plus and Pro raise the limits and add advanced features. The exact details are shown in the app and on the pricing section of the home page at the time you subscribe, so that you always see what you get.

Payments go through Stripe, one of the world’s largest payment processors. PassGram never sees or stores your full card number. After a successful payment your plan is activated on your account automatically.

You can cancel at any time in the app. Your paid features stay active until the end of the period you have already paid for, and after that your account returns to the free plan with your content intact.

Payments are generally not refundable once a billing period has started, but we look at every fair request, for example an accidental duplicate payment. Contact us on X or from Settings → Support and describe what happened.

The developer API is currently in preview. The API page describes authentication, requests, rate limits, webhooks and best practices. Features may change before the general release.

Always on a server, never in a browser page, mobile app bundle or public repository. If a token is exposed, rotate it at once. Give each integration only the permissions that it needs.

Validate the signature on every request, accept only HTTPS endpoints, and respond quickly so that deliveries are not retried. Treat the data you receive as untrusted input.

Use Settings → Support in the app, or message @4rezan on X. Please never send passwords, recovery keys, one-time codes or card numbers.

You can delete your account from the app. Your personal information is removed or irreversibly anonymised, except for the limited records the law requires us to keep. You can export your content first. The Privacy Policy explains the retention periods.

Terms of Use, Privacy Policy and Security are complete pages written in plain language.