--- metadata: - name: generator content: Diplodoc Platform v5.55.0 alternate: - https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-management.md - https://yandex.com/support/browser-mobile-android-tablet/kk/security/passwords-management.md - https://yandex.com/support/browser-mobile-android-tablet/ru/security/passwords-management.md - https://yandex.com/support/browser-mobile-android-tablet/tr/security/passwords-management.md - https://yandex.com/support/browser-mobile-android-tablet/uz/security/passwords-management.md - href: en/security/passwords-management.md type: text/markdown title: Markdown version - href: ../llms.txt type: text/markdown title: llms.txt --- > **Documentation Index:** Fetch the complete configuration index at https://yandex.com/support/browser-mobile-android-tablet/en/llms.txt # Password encryption Hackers are trying to steal passwords in order to access your personal data or e-wallets. To prevent somebody from using stolen passwords, Yandex Browser stores passwords in the [manager](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords.md) in encrypted form. You can strengthen this protection with a master password. ## Password encryption in Yandex Browser{#passwords-crypt} The password vault is encrypted using the [AES-256-GCM](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) algorithm, which uses a [key](https://en.wikipedia.org/wiki/Key_(cryptography)). The AES-256 algorithm is considered reliable: the Department of Homeland Security in the USA recommends using it to protect Top Secret data. However, even the most complex encryption algorithm will not protect your passwords if a hacker learns the encryption key. [The master password](#master-password) allows you to securely protect the key. {% list tabs %} - Using a master password The key is encrypted using the [master password](#master-password). If you forget the master password, you can reset it using a [recovery key](#restore-key). The master password is not stored on devices, so it can't be stolen. With a master password, you are protected in case that: - Theft of passwords stored on your tablet. - Losing passwords if your tablet is lost or stolen. - Synced data stored on Yandex servers (the encryption is set up so that even Yandex cannot decrypt your passwords). - Without a master password This option is less reliable due to the following risks: - Anyone who opens Yandex Browser for Mobile on your tablet can view your passwords in the [manager](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-manager.md). - Your encryption key is protected by your operating system, rather than a master password. If hackers access to your tablet, they can steal and decrypt your passwords. - Yandex can access your passwords during syncing. {% endlist %} ## Master password{#master-password} A master password provides additional protection for passwords. Yandex Browser will request a master password during an attempt to open the password vault or enter a previously saved website password in a login form. Instead of a huge number of passwords from websites, you will only have to remember one master password. Passwords from websites will also be more secure. Access to the vault is locked by the master password, which cannot be stolen, because it's not stored on devices. [Create a master password](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-management.md#create) [Delete a master password](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-management.md#delete) [Time until password vault lock](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-management.md#time) [If you forget your master password](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-management.md#forget) ### Create a master password{#create} {% note alert %} Memorize the master password, do not write it down anywhere and do not show it to anyone. If you forget your master password, you can only restore your passwords if you have a [backup encryption key](#restore-key). {% endnote %} To create a master password: 1. Tap ![](../_assets/settings-menu-icon.svg) → **Settings**. 1. Select **Passwords**. 1. Tap **Create master password**. 1. Enter the master password. Create a [complex](https://yandex.com/support/passport/security.html#password-done-right) yet easy-to-remember password. 1. Tap **Continue**. 1. Enter the master password again. 1. Tap **Create master password**. 1. Yandex Browser will suggest creating a [recovery key](#restore-key). We strongly recommend doing this. {% note alert %} If you forget your master password, your only option would be to delete all the passwords. With a recovery key, you can restore access to them. {% endnote %} Now you will have to enter the master password to save a password for a site in Yandex Browser or open the [password manager](https://yandex.com/support/browser-mobile-android-tablet/en/security/passwords-manager.md). The master password is not saved on your tablet or on the server. Only a key [encrypted with it](https://yandex.com/support2/browser-passwords-crypto/en/with-master.html#procedure) is saved. ### Delete a master password{#delete} 1. Tap ![](../_assets/settings-menu-icon.svg) → **Settings**. 1. Select **Passwords**. 1. Tap **Delete master password**. 1. Enter the master password and tap **Confirm**. After that, the browser will no longer request the master password to access passwords. At the next [synching](https://yandex.com/support/browser-mobile-android-tablet/en/devices/sync.md), the master password is deleted from the other devices. ### Time to lock password vault{#time} Choose when Yandex Browser will lock the password vault and start requesting the master password during an attempt to access it: 1. Tap ![](../_assets/settings-menu-icon.svg) → **Settings**. 1. Select **Passwords**. 1. Tap **Access to saved passwords**. 1. Enter the master password. 1. In the **Lock access** section, choose **After restart**, **After lock screen**, or **Never**. ### If you forget your master password{#forget} {% note info %} If you reset the master password without a [recovery key](#restore-key), saved passwords will be deleted. {% endnote %} If you have created a [recovery key](#restore-key): 1. In the form where you enter your master password, tap **Forgot password**. 1. Tap **Reset master password**. 1. Enter your Yandex ID password. 1. [Re-create](#create) your master password. If you haven’t created a recovery key, you won’t be able to restore access to your passwords. ## Gesture, PIN code, fingerprint {#pin-fingermark-gesture} To avoid entering the [master password](#master-password) every time you unlock your , lock the device using one of the conventional methods instead (PIN, gesture, or fingerprint). Your passwords in the storage will still be encrypted with the master password. Each time you unlock your device, the browser will restore your master password and then decrypt the password vault. If you delete your master password, the browser will no longer ask for your (PIN, gesture, or fingerprint). {% note info %} The lock method is linked to the device. That's why you can't use a PIN from one to get access to passwords stored on another one. {% endnote %} To change the password unlock method: 1. Tap ![](../_assets/settings-menu-icon.svg) → **Settings**. 1. Select **Passwords**. 1. Tap **Access to saved passwords**. 1. Enter the master password. 1. In the **Unlock with** section, select one of the options: master password, fingerprint, gesture, or PIN. The options available depend on your model. ## Backup encryption key{#restore-key} The master password serves to make your [passwords more secure](#passwords-crypt), but what if you forget it? Yandex Browser has a convenient and [reliable way](https://yandex.com/support2/browser-passwords-crypto/en/with-master.html#restore-key) to reset the master password. The master password is only needed to decrypt the private key, so if you keep a copy of the private key (a spare encryption key), you can extract it and encrypt it with a new master password. Some password managers suggest that the user prints out the recovery key (in some cases, as a QR code). This method isn’t secure enough because the printout could be lost. That's why we store the spare encryption key on your device and encrypt it with another additional key, which we store on the server. You can access the key on the server only after entering your Yandex ID password. It's very unlikely that a hacker could steal all three: the spare key from the device, the key from the server, and your Yandex ID password. ![](../_assets/spare-key.svg) To prevent you from accidentally losing access to the password vault, Yandex Browser suggests creating a recovery key immediately after [creating the master password](#create): 1. When the **Enable option to reset master password?** window opens, tap **Enable**. 1. Enter your [Yandex ID](https://yandex.com/support/id/en/authorization/registration.html) password. Since one of the keys is stored on the server, [syncing](https://yandex.com/support/browser-mobile-android-tablet/en/devices/sync.md) is required. If syncing is not enabled, it will be enabled automatically after entering the Yandex ID password. #### Learn more - [Password encryption in Yandex Browser](https://yandex.com/support/browser-passwords-crypto/) Contact support