Set up 9Secure.

Create a keyring, create or import your first vault, and complete your first local Sync.

Install and open 9Secure

1. Get 9Secure from the download page.
2. Open the app.
3. Review the End-User License Agreement, then select Accept.

Set up or import a keyring

A keyring protects the keys that unlock your vaults. Choose one path:

• Set Up Keyring creates a new keyring and Recovery Key.
• Import Keyring lets you select an encrypted .9keyring archive, enter its Keyring password, select Import, then unlock the imported keyring.

If you import, the password, Argon2id, device-unlock, creation, and Recovery Key sections below apply only to new keyrings.

Choose a keyring password

• Diceware creates a long passphrase from random words. The default five-word passphrase is rated Strong. Add words or select Reroll for a new passphrase.
• Structured creates compact, pronounceable segments with a number and uppercase letter. The default three-segment password is rated Strong. Add segments or select Reroll for a new password.
• Custom accepts your own password and requires confirmation. Use a long password that is unique to this keyring.

Diceware and Structured use the operating system's cryptographically secure random number generator. Save the selected password somewhere secure.

Four-digit PINs provide limited protection. They are better than storing sensitive information in plaintext notes, but a numeric PIN has only 10,000 possible combinations. It offers little resistance if an attacker obtains a copy of your keyring.

Keep the recommended Argon2id preset

Argon2id makes password guessing consume memory and time. Keep the preset marked Recommended.

Windows and macOS: The current recommendation on Windows and macOS is High.

iOS, iPadOS, and Android: Medium is both the recommended and highest supported preset on iOS, iPadOS, and Android. Mobile apps offer Low and Medium, not High or Maximum.

The preset belongs to this keyring, not to a vault. When you create a separate keyring on each device, each can use its own password and preset while synchronizing the same vaults. Sync does not copy these settings. For example, a desktop can use High while a phone uses Medium.

Higher presets increase memory use and password-unlock time as well as the cost of password guessing. They do not change the vault's encryption algorithm. To choose a different preset later, open Keyring > Change Password. See the security implications before lowering it.

Choose device unlock

Device unlock makes daily access faster but does not replace the keyring password or Recovery Key.

Windows: Leave Windows Hello on when available. It can use your face, fingerprint, or Windows PIN.

macOS, iOS, and iPadOS: Leave Unlock with Touch ID, Face ID, or device password enabled if you want device-authenticated unlock.

Android: Enable Biometrics to unlock with a supported strong biometric or your device PIN, pattern, or password. Set up a device screen lock first if this option is unavailable.

Create your keyring

1. Review the password, Argon2id preset, and device-unlock choice.
2. Select Create Keyring.

Save your Recovery Key

The Recovery Key unlocks an existing keyring if you forget its password or lose device unlock. It cannot recreate missing keyring or vault files.

1. Save the Recovery Key somewhere secure and separate from this device.
2. Protect it like the keyring password. Anyone with the key and keyring file can unlock the keyring.
3. Select Done.

You can view it again later from Keyring.

Create or import your first vault

A vault is an independent encrypted file and Sync boundary. Start with Personal. Add Work for work credentials and Media for large attachments. Sync Personal and Work where needed, and keep Media on storage-rich desktop devices unless another device needs it.

1. Select New Vault, enter a name, and choose an icon.
2. Choose one path:
   • Select Import to bring in logins from a supported browser or password manager. Choose the provider, follow its export instructions, select Choose File, then select the exported file.
   • Select Create to start with an empty vault, then:
     1. Open the vault and select New Item.
     2. Enter an item name and choose Login.
     3. Enter the Username and Website, then review or replace the generated Password.
     4. If the account uses TOTP, select Add Authenticator. Scan its setup QR code with the camera on iOS or Android, import a QR image, or enter its Base32 secret or otpauth://totp URI manually.
     5. Select Create and verify the saved fields and rotating code.

9Secure imports supported Login items and reports anything that must be recreated manually. Export files contain plaintext secrets, so delete the exported file after confirming the import.

Authenticator accepts a manual Base32 secret or a otpauth://totp URI. Manual secrets use SHA-1, six digits, and a 30-second period. TOTP URIs can use SHA-1, SHA-256, or SHA-512, six or eight digits, and a period from 1 through 300 seconds. HOTP is not supported.

Other item types include Payment Card, Bank Account, Address, Identity, Software License, WiFi Network, SIM / eSIM, Email Account, Crypto Wallet, API Credential, SSH Key, Secure Note, File, and Custom. Each type provides fields suited to that information.

QR import fills the editor without saving it. On macOS and Windows, use the image button to choose, paste, or drop a QR image; there is no camera scanner. See Authenticator QR setup for each platform's options and troubleshooting.

Authenticator and passkeys are extensions of a Login, not separate item types. See Items and Credentials for passkey setup, the complete item list, and SSH Key commands.

Complete platform access

macOS: On macOS, select Enable for Vaultlight Accessibility on the welcome screen or in Settings. It is required for Paste, Type Out, and global Escape.

Complete your first Sync

1. Open Sync on two unlocked, awake devices connected to the same local network.
2. Turn on Sync on both devices and allow local-network access if prompted.
3. Select Pair a Device or Pair Device on both devices, then select the discovered device.
4. On one device, select the number shown on the other, then select Confirm on both devices.
5. Enable the vault under the paired device and select Sync or Sync All.
6. Open the vault on the receiving device and verify the Login.

Completed Sync leaves recovery copies on the receiving device if the original device is lost or fails. Enable and verify every vault you want covered. See the Sync guide for vault subscriptions, deletion, and troubleshooting.

Finish setup

• Open Sentinel, select Run Audit, and review the findings.
• Read Security Architecture before exporting keys, exporting vaults, or using Archive Keyring.
• Windows and macOS: For backups, select Lock first, copy the encrypted vaults and keyring to a separate drive or device, then test the copies. On Windows, closing the window may only hide or minimize 9Secure; use Lock or fully quit from the system tray.
• iOS, iPadOS, and Android: iOS and Android can export encrypted vault copies from Keyring, but have no non-destructive active-keyring backup action. Archive Keyring removes the active keyring and is not a routine backup.
• Lock 9Secure when finished.