Hi Itamar,

Thank you for contacting us. Depending on the situation you're in, you may not need to worry about this QR code or your password. Are you trying to upgrade to mSecure 5 from mSecure 4? If so, do you have all of your data stored in the mSecure 4 app?

@Tom and @Tam The QR code the system sends to you stores data in it that's encrypted with your password. So if you have forgotten your password the data in the QR code is no longer useful. In these cases, the only way to get access to your account is to reset it first.

Can both of you confirm for me that you still have access to your information on your old iPhones? Also, if you do have access to your information on the old devices, I need you to let me know which version of mSecure you are running on those devices. Does the app icon that you tap to see your data have a very dark blue background or is it a brighter blue color? If you know how to get the version number from in the apps's settings, that would be great to have as well.

@Tam I'm not sure exactly what's happening here, but mSecure can't change the password on you. It's difficult to explain, but if that were possible, your data wouldn't be able to be encrypted/decrypted correctly. mSecure 5 is stable just like mSecure 4, as it's about 4 years into production and now on the way out with v6's release just around the corner.

On your iPhone, if you are able to access your data using Face ID, you can simply change your password in mSecure's Settings on that device. To do that, open the app, use Face ID to unlock it, tap the menu icon in the top left corner, tap Settings, then tap the option to change your password. You should see the Face ID UI pop up, and after you have been authenticated by iOS, your current password should be entered in to the first field. After that happens, you can simply enter a new password two times along with a hint, and you'll be good to go.

@Sandy The QR code you have is encrypted with your account's password, so it is not useful unless you are able to sign in to your account first. That code is an authentication mechanism, so it has to be decrypted before mSecure can use it, which his why it will only be requested by mSecure after you are able to sign in to your account.

Real quick, do you still have access to mSecure on your old phone by chance? If so, do you know what version of mSecure is running on the old device?

Hi Joe,

Unfortunately, there is nothing that can be done in this situation. The ability to access your mSecure account hinges entirely on knowing the password for the account. If that password is forgotten, the security measures in the app will not allow access to the data, and those security measures cannot be bypassed.

As mentioned earlier in this thread, the QR code you have is encrypted with your account's password, so it is not useful unless you are able to sign in to your account first. That code is an authentication mechanism as well as the key used to encrypt/decrypt the data stored in the app, so it has to be decrypted before mSecure can use it.

For further clarification, if the password is forgotten, the only way to gain access again is to perform an account reset which makes you set a new password. When an account reset is performed, however, all of the data stored in the account gets destroyed. The reason for this is that the data stored in mSecure is encrypted with what is known as an account key. That key is only ever saved or transmitted in an encrypted form, and your account password is what is encrypting that key. When the password is forgotten, the account key can no longer be decrypted, so the information stored in the app cannot be decrypted either.

With regards to password recovery, while we are constantly looking for secure ways to implement this type of feature, it is a very, very tricky concept. In order to have the possibility to recover a password, that password must be stored somewhere in order for it to be retrieved. Whenever a password is stored in any location, the security of the system is compromised in some way, and this is a risk we are not willing to take. There's no way the password could ever be stored in your account on our servers, so that is most definitely out of the question. We can send the user recovery keys when they sign in to their account, but those would need to be saved somewhere extremely safe. Since the password itself can be saved in a safe location, recovery keys simply add a layer of complexity we're not sure would ever be helpful.

There are certain password managers that do have password recovery features, which are always optional, but we aren't convinced they are safe. Again, we're always looking for a solution, but before a password recovery feature is implemented in mSecure, we will have to be certain the risks are limited to an extent that it's reasonably impossible for a thief to gain access to the user's information.

@Tu When you change the sync feature for mSecure, it does not have any effect on the password for your account. It's literally not possible that changing the sync feature is causing either device to show a password change message. I tried finding an account with the email address you are using here in the forum, but I was not able to find one. If I can find your account, then I can check different properties to see if I can figure out what's going wrong. Can you let me know what the email is on your mSecure account?

Also, please do not reset your account at this time. There are too many things that go wrong if you do that, so it's best to keep things the way they are until I can fully understand the situation. In the end, it may be that I can fix this without the need for an account reset at all.