mSecure Support
mSecure assessment by The Federal Office for Information Security (BSI)
Hi,
Thank you for contacting us. The first thing I want you to read is our security model which goes into what we use for our security: mSecure's Security Model - Secure By Design. AES-256 bit encryption is still strong encryption, it may not be the strongest there is, but there are draw backs with using higher bit encryption that we take in account as well. Being able to change your password using your biometrics does not pose a risk since if someone did steal your device, they would first need to know your phone password to get inside your phone. They would then need your account password to unlock the mSecure app and if they changed biometrics at all on your device, this would force them to enter the correct account password to unlock the app. If you have a different device, you would simply need to change your password and if they guessed your old strong password, they would then be locked out and forced to enter your new strong password which is very, very unlikely.
Using a sharing key when sharing data allows a specific user access to any data shared to their account which stays encrypted throughout the sharing process. This is not a questionable concept since the encryption is the same whether you are sharing data with a user, or if you are not sharing.
If mSecure had access to your account password, we would have a way to recover your password if it is forgotten, but since we do not have access to this information, we are unable to recover lost passwords. We are planning on getting an audit done for mSecure 7 since many of our users have requested this, so this will show in more detail on how secure your data is when using mSecure as your password manager.
Hi Mark
thanks for your prompt response and explanations.
I'm a long-time and happy user of mSecure but the BSI report made me a bit nervous. Therefor I was already looking for open source alternatives as closed source solutions nowadays force users into cloud synchronization - which I dislike.
I'm looking forward to the outcome of the security audit. Any indication when this will take place?
Kind regards, HJ
Hi,
Thank you for your response. mSecure does not force users to sync via a cloud service, which is why many of our users like using our app. I don't have a specific date on when this audit will occur, but we are making this a priority to get done soon after our next updates are released. Thank you and please let me know if you need further assistance.
Thank you Mark. Topic closed!
Hans-Josef
The Federal Office for Information Security (BSI) is the federal cybersecurity authority and designer of secure digitization in Germany and has assessed mSecure in 2025, amongst other password managers.
The findings make me wonder whether messures have been taken to improve the situation?
kind regards, HJ
Assessment and Recommendations for Consumers
Overall, the concept does not meet the usual expectations for password managers. Additional characteristics reinforce these security concerns. Users should carefully consider whether they can extend the necessary trust to the manufacturer without an objective basis before using the product.
Information about the employed concept, cryptographic mechanisms, conducted security audits, the software development process, and the third-party components (software libraries) used is not publicly and transparently available, which makes conducting security investigations more difficult.
Communication with the Manufacturer
mSeven Software did not respond to technical inquiries. In response to the audit report, the manufacturer stated that the secrets transmitted to them are not stored. Furthermore, the manufacturer confirmed the transmission of part of the key in the password-sharing feature.
Key Audit Findings
Significant deviations from common recommendations were identified.
Technical information is sent to the manufacturer, allowing them to access the contents of the password manager.
Furthermore, the biometric access control allows the setup of a new master password without knowing the old one, which poses a risk, especially for stolen devices. The recovery mechanism is based on this function.
The implementation of the password-sharing feature ignores common best practices and relies on a questionable concept that involves sending part of the key.
mSecure uses an RSA key length of 2048 bits, which does not meet current recommendations (see BSI TR-02102-1).