Sign in to KeyNesta
Current as of 21 September 2026.
If you are looking for a KeyNesta login page, there is not one in the usual sense. KeyNesta is not a site you log into to see your codes: the codes are computed on your device, from data that is already there. You open the app, unlock your vault with its passphrase, and that is all of signing in. An account is a separate and optional thing, and it exists for one reason only.
Open your vault in the browser
- Go to app.keynesta.com. There is nothing to install and no sign-up step in front of it.
- First time: create a vault. Give it a name and a passphrase of at least 12 characters. No email address, no verification step, nothing uploaded.
- Coming back: the lock screen lists the vaults already on this device. Pick one, type its passphrase, and the vault is decrypted in the page.
That passphrase is not a credential travelling to a server. It is stretched with scrypt and used to unwrap the key that decrypts the vault, on your device, which is also why nobody at KeyNesta can reset it for you. The encryption architecture sets out the parameters.
Vaults auto-lock while you are away — after five minutes by default, and 1, 15 or never are the other choices — so coming back to an open tab usually means typing the passphrase again.
No account is needed to generate codes
Everything that happens on one device works with no account at all: generating TOTP and HOTP codes, vaults, spaces, groups and tags, ranked search, imports, encrypted backup files and export. A code is computed from the secret and your clock, both of which are local, so none of it needs a server to be reachable.
An account exists for one thing: sync
With sync on, your vault is uploaded as ciphertext the server has no key for, and another device signed in to the same account decrypts it locally with your passphrase. That is the only reason to create one. Turn it on in Settings, then Sync: either create an account with an email address and a password, or sign in with Google; the lock screen also offers Apple. On Android, sign-in is email only today.
Turning on sync walks through what happens the moment you sign in, and what sync uploads covers what the server can and cannot see.
Two secrets, two jobs
Nearly every sign-in question we get is these two being mistaken for one another:
| Account password | Vault passphrase | |
|---|---|---|
| What it is for | Identifying you to the sync service. | Decrypting your codes. |
| Minimum length | 8 characters | 12 characters |
| Reaches our server | Yes, to sign you in | Never |
| Can be reset | Yes, by email | No, by anyone |
Signing in with Google or Apple replaces the first of those and never the second. So if a sign-in succeeds and the app then asks for something else, what it is asking for is the vault passphrase.
No phone number, ever
KeyNesta never asks for a phone number: not to create an account, not to sign in, and not to get back into one. An authenticator that ties your second factor to a SIM card reintroduces exactly the attack — SIM swapping — that a TOTP app exists to avoid. Authenticator app vs SMS goes through what that attack looks like in practice.
If you would rather have no account at all
Move the vault with an encrypted backup file instead. It is a snapshot rather than a live copy, so two devices drift apart as you add codes, but no account ever has to exist. See 2FA backup and sync.
When signing in does not go through
- "That passphrase does not match this account." The account password has been typed where the vault passphrase belongs, or the passphrase of a different vault. Nothing is damaged by a wrong attempt.
- Google sign-in refused on an account you already have. That account was created with an email address and a password and has never proved that it owns the mailbox. Use Forgot password on that address once; the social sign-in works from then on, and the full explanation is in the help center.
- The vault passphrase is gone. There is no reset and no recovery route, by anyone, by design. Lost phone recovery covers what can still be done, account by account.
Frequently asked questions
Is there a KeyNesta login page?
Not in the usual sense. Open app.keynesta.com and unlock a vault with its passphrase; the codes are generated on your device rather than fetched from a server, so there is nothing to log into to see them. A sync account is separate and optional.
What do I type on the lock screen?
The passphrase of the vault you picked, which is at least 12 characters and was chosen on the device that created it. If you signed in to a sync account first, that account password is a different secret and will not open the vault.
Can I use KeyNesta without giving an email address?
Yes. Creating a vault asks for a name and a passphrase and nothing else, and everything on that one device works from then on. An email address is only needed if you create a sync account so the vault can travel to a second device.
Will KeyNesta ever ask for my phone number?
No. There is no phone number field anywhere in KeyNesta, for sign-up, sign-in or recovery. Tying a second factor to a SIM card would reintroduce SIM swapping, which is one of the attacks an authenticator app exists to avoid.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms