Questions, answered plainly.
Including what we can see, what we can’t, and what happens when things go wrong.
General
What is StashOS?
A password manager and an encrypted file drive in one place. You can use it as a classic vault, or open the Desktop: a windowed workspace with folders, previews and search, where every item is encrypted in your browser before it is uploaded.
Who is it for?
People who keep important documents next to their passwords — ID scans, contracts, medical and tax records, recovery codes — and want both in one place that the provider cannot read.
Do I need to install anything?
No. It runs in any modern browser. You can also install it as an app from your browser (it is a Progressive Web App), which gives it its own window and icon on desktop and mobile.
Can I move my passwords from another manager?
Yes. Import a CSV export from Bitwarden, 1Password, LastPass, Dashlane, Proton Pass, KeePass, Apple Passwords, Chrome, Edge or Firefox. The file is parsed and encrypted in your browser; the plaintext CSV is never uploaded. You can export your vault again at any time.
Security & privacy
What does “zero-knowledge” actually mean here?
Your master password never leaves your device. Your browser turns it into an encryption key and uses that key to encrypt everything before upload: passwords, usernames, website addresses, titles, folder names, file names and file contents. Our servers only ever store the encrypted result.
Which algorithms do you use?
AES-256-GCM for encryption, with a fresh random IV for every item. The key is derived from your master password with PBKDF2-SHA256 at 600,000 iterations and a per-account random salt, and it is created as non-extractable inside the browser’s Web Crypto API. Your login password is hashed separately on the server with Argon2id.
What can you see about my account?
Your email and username, how many items you have, the size of each encrypted file, how your folders nest inside each other, timestamps, and the IP address of requests (used for rate limiting). We cannot see what any of those items are called or what they contain.
What happens if I forget my master password?
Use the recovery code from the recovery kit you saved when you set up your vault: it lets you choose a new master password. Without that code your data cannot be recovered — not by you, not by us. That is the price of an encryption key that only you hold.
Why are there two passwords?
The login password proves who you are to the server. The master password unlocks your vault and never leaves your browser. Keep them different: if they were the same, the server would see the secret that protects your data.
Where is my data stored?
On servers we operate in the European Union. Because everything is encrypted before upload, the files on those servers are unreadable without your master password.
Has the code been independently audited?
Not yet. The cryptography uses the browser’s standard Web Crypto primitives rather than custom code, and we publish our security model in full. If you find an issue, please report it — see the Security page.
Desktop & files
What is the Desktop?
A full workspace in your browser that feels like a computer: draggable windows, a Files app, your Vault, a Trash, Quick Look previews and a dock. Passwords and files live in the same folders, so the folder “Car” can hold the insurance PDF and the insurer’s login.
Can I preview files without downloading them?
Yes. Quick Look opens PDFs, images, video, audio and text files right on the Desktop. The file is decrypted in your browser’s memory for viewing and never written to disk unless you choose to download it.
How does search work if everything is encrypted?
Press ⌘K (or Ctrl+K). Search runs in your browser over your already-decrypted vault, so it finds passwords, files and folders by name without the server ever seeing the query.
Is there a file size limit?
Each file can be up to 50 MB. Your total storage depends on your plan. Files are encrypted on your device, so very large files take a moment before the upload starts.
What happens when I delete something?
It goes to the Trash first, where you can restore it. Emptying the Trash deletes it permanently.
Plans & billing
Is the free plan really free?
Yes, with no time limit. Passwords are unlimited on every plan; paid plans add file storage and priority support.
Can I change or cancel my plan?
Any time. If you downgrade below your current storage use, nothing is deleted: you keep access to everything, but cannot upload new files until you are back under the limit.
Do prices include VAT?
Prices are shown in euros. VAT is added at checkout where it applies, depending on your country.