1. Our approach
We design security around a few simple principles. First, minimise what we can see: private content is encrypted so that we cannot read it. Second, make the safe thing the easy thing: approvals appear on your own device, in your own app, and not on a channel an attacker can intercept. Third, assume things go wrong: every code expires, every request can be used once, and every session can be ended from another device.
- Encryption in transit and at rest.
- Sign-in approvals delivered to your signed-in app.
- Short-lived, single-use codes and QR requests.
- A visible list of active sessions with one-tap termination.
- Server-side rules that stop one account from reading another’s data.
2. Encryption
All traffic between your device and PassGram uses TLS, so that others on the same network cannot read or change it. Content in your private vault is encrypted on your device before it is uploaded, and the keys that unlock it come from secrets that only you control. Because of this, our servers store encrypted data that we cannot read.
Sensitive values that our servers must verify, such as one-time codes, are stored only as salted one-way hashes. A copy of the database is therefore not enough to recover a code, and codes expire within minutes anyway.
3. How new-device sign-in works
3.1 Sign in with a QR code
On the web app you choose “Sign in with QR code”. The page shows a QR code that contains a one-time request identifier. You scan it with the PassGram app on a phone that is already signed in, check the device name, location and time, and approve. The web page then receives a sign-in only for that request.
- A QR code is valid for ten minutes; after that you must create a new one.
- It can be approved only once and by one device. Re-scanning a used or expired code shows an “already used or expired” message.
- The code does not contain your password, your keys or any secret that would let someone sign in by photographing it.
3.2 Sign in with a one-time code
If you sign in with a username and password on a new device, a six-digit code is delivered straight to your signed-in PassGram app instead of an SMS. Text messages can be redirected by SIM-swap attacks; your own app cannot. You enter the code on the new device to finish. Codes expire quickly, work once, and the number of attempts is limited.
3.3 The security notice
Every new sign-in produces a notice from the PassGram security system in your app. It states your username, the time in UTC, the device and the approximate location, and explains how to end the session. The notice comes from a read-only system account: no one can message it, impersonate it or change what it says.
4. Active sessions
Open Settings → Devices in the app to see each place you are signed in. For each session you can see the device name, the approximate location and when it was last active. If you do not recognise a session, end it immediately and change your password. Ending a session signs that device out and invalidates its token.
5. Your master password and recovery key
Because we cannot read your vault, we also cannot reset your master password for you. Your recovery key is the only way to regain access if you forget it. Store it offline, for example printed and kept somewhere safe. Do not keep it in a screenshot, an email or an unprotected note, and never give it to anyone who contacts you, no matter who they say they are.
6. Protection against abuse
- Rate limits slow down password guessing and code guessing.
- Expiry and single use make intercepted codes and requests worthless after a short time.
- Access rules on the server verify who you are for every read and write.
- Monitoring looks for unusual patterns, such as many failed attempts, and triggers extra checks.
- Scheduled cleanup deletes expired sign-in requests so they do not linger.
7. Habits that keep you safe
- Use a long, unique master password. A passphrase of four or more random words is a good choice.
- Turn on two-step verification and keep your recovery key offline.
- Only approve a QR or code request that you started a few seconds ago.
- Keep your phone’s operating system and the PassGram app up to date.
- Install apps only from official stores and from links on this website.
- Review your active sessions every few weeks.
- Use the lock screen on your phone; a stolen unlocked phone is a stolen account.
8. Recognising scams
Attackers rely on urgency and on tricking you into handing over a code. Remember that:
- PassGram will never ask for your master password, recovery key or one-time codes.
- A message that says “your account will be closed in 24 hours, click here” is a scam.
- A person who asks you to “read out the six digits you just received” is trying to take over your account.
- Official links are on passgram.web.app and web.zpas.org. Look closely at the address before you type anything.
- If you are not sure, close the page and open the app yourself.
9. Security for developers
Keep API and bot tokens on the server, never in a browser page or a public repository. Rotate a token immediately if it was exposed. Validate webhook signatures, use the least permission each integration needs, and log what your integration does so you can investigate problems.
10. Report a vulnerability
We welcome good-faith security research. If you find a weakness, please tell us privately before you disclose it publicly so that we can fix it. Include a clear description, the steps to reproduce it, and the impact you believe it has.
- Contact us through @4rezan on X and ask for a private channel, or use Settings → Support in the app.
- Do not access, change or delete data that is not yours, and do not disrupt the Service while testing.
- Give us a reasonable amount of time to fix the issue before sharing details.
- We will not take legal action against researchers who follow these rules, and we are glad to credit you if you wish.
11. If something goes wrong
If we find that your information was exposed, we will contact you in the app, explain what happened, what we did to stop it and what you should do. If you suspect your account is compromised: end all other sessions, change your password, rotate your recovery key if it may have been seen, and contact us.