SECRET FORT SUPPORT
Secret Fort Frequently Asked Questions
Identical to the in-app FAQ (as of 2026-07-18).
What are the password requirements? Do I need symbols or uppercase letters?
The only requirement is a minimum length of 15 characters. No mix of uppercase, lowercase, digits, or symbols is required (this follows the current security guideline, NIST SP 800-63B).
However, easily guessed patterns such as a repeated character (e.g. aaaaaaaaaaaaaaa) or a sequence (e.g. 123456789012345) cannot be used.
A long passphrase made of several words is easy to remember and strong, and is what we recommend.
After adding or re-enrolling a fingerprint/face, biometric unlock stopped working
This is by design. When the biometric enrollment on your device changes, the OS automatically invalidates the biometric unlock key. This is a security feature that prevents someone from adding their own fingerprint to your device and unlocking the app.
Sign in with your master password, then re-enable biometrics under Settings → Security. Your data is not lost.
The app locks too often / keeps asking for my password
You can adjust this under Settings → Security.
Turning off “Re-authenticate on resume” removes the re-authentication when you switch to another app and back. You can also change the “Re-authenticate after timeout” duration.
On devices with biometrics, enabling biometric unlock lets you handle day-to-day unlocking with just your fingerprint or face.
After several wrong password attempts I can no longer type it in
Repeated wrong attempts lock the input for a period of time. This protects against brute-force guessing of your password.
Once the displayed time has passed, you can try again. A lockout never deletes your data.
Biometric unlock is not available on Windows
This is by design. Windows lacks an OS-protected area that can bind a key to biometric authentication securely (other programs running under the same user could read the key). Because we do not ship features that cannot be implemented safely, biometric unlock is intentionally disabled on Windows.
Please unlock with your master password on Windows.
How do I move to a new device?
The steps are:
- Old device: connect a cloud storage service under Settings → Cloud Sync and let it sync.
- New device: install the app and choose “Restore from Cloud” on the first screen.
- Connect the same cloud account and enter your master password. That completes the restore.
No key files or QR codes are needed. Even if the old device is broken or lost, the same steps work as long as cloud sync was enabled.
The “Choose Data” screen appeared. Which one should I pick?
This screen appears when data exists both in the cloud and on this device. Use the last-updated time and item counts shown on screen to pick the one you want to keep.
The version you do not choose is automatically saved to the cloud as a snapshot file, so you can retrieve it later even if you pick the wrong one.
If you are unsure, choose “Cancel” — neither side is changed.
I want to switch to a different cloud service
Disconnect the current service under Settings → Cloud Sync, then connect the new one. The data on your device is kept and uploaded to the new cloud.
You can manually delete the files left in the old cloud if you no longer need them. They are encrypted, so leaving them there does not expose their contents without your password.
What happens to my data if I uninstall the app?
The data on the device is deleted.
If cloud sync was enabled, you can reinstall the app, choose “Restore from Cloud”, and enter your master password to get everything back.
Without cloud sync there is no way to restore. We strongly recommend enabling cloud sync — it also protects you against device failure or loss.
After changing my password, the cloud backups disappeared
This is by design. When you change your password, all generation backups and snapshot files are deleted from the cloud so that no file openable with the old password remains, and a new backup protected by the new password is created.
This is why the confirmation dialog warns you before the change. If you want to keep an old version, download the files manually from your cloud before changing the password.
I got a warning that the cloud data is older than a version this device has synced
This appears when the data fetched from the cloud is older than a version this device has already synced. It is a security feature that detects rollbacks (swapping in an old version of your data).
It also appears if you yourself restored the cloud files from a backup. If you have no idea why it appeared, check whether your cloud account has been accessed by someone else (e.g. its sign-in history).
If you intentionally want to go back to an older version, reconnect cloud sync and explicitly pick the version to adopt on the “Choose Data” screen.
I cannot take screenshots / the screen is black when sharing
This is by design. To prevent leaks of confidential information, the app suppresses screenshots, screen recording, and previews in the app switcher. It is not a malfunction.
I changed the OS language, but tab and field names did not change
Tab and field names are part of your data, created in the language that was active when the vault was created. Just as names you enter yourself are never auto-translated, they do not switch automatically when the OS language changes.
You can rename them under Settings → Manage tabs. The app’s own labels and messages do follow the OS language.
Limitations of automatic clipboard clearing
Automatic clipboard clearing works only while the app is running in the foreground or background. If the app is force-quit or its process is reclaimed by the OS, the clipboard may not be cleared.
Also, if a keyboard app or clipboard manager keeps its own copy of the copied content, clearing from Secret Fort may not take effect there.
For better security, we recommend manually checking the clipboard contents after copying sensitive information.
What happens if I lose my password
Your password is the source of the key that encrypts your vault data. If you lose your password, all stored data becomes permanently inaccessible.
Secret Fort uses a zero-knowledge design: neither servers nor the app developers ever know your password, so there is no way to reset or recover it.
Even with biometrics enabled, the password is required when switching devices or re-enrolling biometrics. We strongly recommend keeping your password recorded in a safe place.
Decrypting data after the app is discontinued, and where the published specification lives
Secret Fort publishes its encryption specification so that you can decrypt your data even after the app is no longer available.
Vault data is encrypted with AES-256-GCM, and the encryption key is derived from your password using Argon2id. These are all standard cryptographic algorithms available in libraries for common programming languages.
The detailed technical specification of the data format and decryption steps is published in the External Decryption Specification on the JaMTec website. With cloud sync enabled, the encrypted files and the specification are enough to decrypt your data with third-party tools.
Generation backups (vault.bak1-3.dat) and replacement snapshot files (vault.replaced.*.dat) use exactly the same format as vault.dat and can be decrypted with the same steps.
Why the OneDrive integration requests broad access
When linking with OneDrive, Secret Fort uses the Files.ReadWrite permission (read/write access to all of the signed-in user’s files). The app actually reads and writes only the files inside the “Secret Fort” folder at the root of your drive.
A narrower app-folder permission exists, but Secret Fort prioritizes your ability to recover your data on your own: even if the app ever becomes unavailable, you can find and download the files directly in the OneDrive interface and decrypt them using the published decryption specification. Storing the data in an easy-to-find folder at the drive root is why this broader permission is used.
Why the Google Drive integration requests broad access
When linking with Google Drive, Secret Fort uses the drive scope (read/write access to your entire My Drive). With the narrower drive.file scope, file access is isolated per app installation (client), so multiple devices cannot share the same “Secret Fort” folder. This broader permission is used so that your data can be synced across multiple devices.
Your vault data is encrypted on your device before it is stored in Drive, so its confidentiality is preserved even though the permission is broad.
Note that if the Google Drive access token were ever leaked to a third party, the impact could extend beyond the Secret Fort folder to other files in your Google Drive. We recommend keeping device-level protection, such as a screen lock, enabled.
Does changing my password revoke the old one
When you change your password, Secret Fort generates a new internal data-encryption key (DEK) and re-encrypts your entire vault with it (the key’s generation number is incremented by one). At the same time, the data in the cloud is replaced with a version protected by your new password, and old backups and snapshot files that could be opened with the old password are deleted from the cloud.
As a result, the old password can no longer open your current data. Unlike before, you do not need to recreate the vault for the key to change — changing your password alone rotates the internal key.
However, if a third party had already obtained a copy of an encrypted file before the change, that copy is encrypted with the key that was in effect at the time and can still be opened with the old password. No mechanism can retroactively invalidate a copy that has already leaked. If you suspect a leak, in addition to changing your password, consider also changing the sensitive values themselves (such as the passwords for each service).