How Your Passwords Are Protected¶
This page explains, without jargon, what stands between your passwords and anyone else. If you only remember one thing: your items live in Apple's Keychain on your own devices, and Pebble IT has no copy of them and no way to read them.
Where your items are kept¶
Every item is kept in your device's Keychain, the protected storage Apple's own apps use for saved passwords. Apple encrypts the Keychain (with AES-256), and it can be read only while your device is unlocked.
Each item is kept in two parts:
- What the lists show: its name, website, Type, tags and dates, and the one value its template shows beside the name, such as a login's username (never a password or a hidden value). This draws your lists, so you can find an item without opening it.
- Everything else: its passwords, notes and other fields. These are shown only after Private Passwords has checked it's you.
Credential Health and Merge spot repeated passwords and matching usernames by fingerprints made with a secret key kept in the Keychain, so the lists can show them without an item being opened. Without the key, a fingerprint says nothing about what it was made from.
There's no Pebble IT server and no account. See What the App Never Does.
Face ID or Touch ID before an item opens¶
Private Passwords checks it's you before it opens an item, edits one, deletes one, opens Settings or starts a merge, and before every Import, Export, Back Up, Restore, Empty the Bin and Delete All Data.
Face ID or Touch ID, whichever your iPhone has. Where neither can be used, because it isn't set up or is locked after too many tries, your iPhone's passcode, in Apple's own box.
Touch ID. Where it can't be used, on a Mac without it, or with it not set up or locked after too many tries, your Mac's login password, in Apple's own box.
There's never a password of the app's own to remember. A device with no passcode (or a Mac with no login password) can't use Private Passwords at all: the app says so and opens nothing.
The Unlock Period¶
After you unlock, nothing asks again for the Unlock Period: 900 seconds (15 minutes) unless you change it, anywhere from 0 to 50,000. Each unlock starts the time again. With 0, you're asked every time.
The Unlock Period is for Touch ID and the passcode. With Face ID there's none: Face ID asks every time, and Settings doesn't show the Unlock Period. Where it applies, it covers AutoFill too.
It ends early when you lock Private Passwords (Lock in the menu, or the Idle Timeout), when Private Passwords is closed, and when your iPhone locks while Private Passwords is open or has only just been left.
The Unlock Period covers Touch ID and your Mac's password alike, and Settings always shows it.
It ends early when your Mac locks, sleeps, starts its screensaver or switches to another user, and when Private Passwords quits.
Some things always ask afresh, whatever the Unlock Period: Delete All Data, Import, Export, Back Up, Restore and Empty the Bin; changing the Unlock Period itself; and turning off the launch lock.
See Face ID, Touch ID and the Unlock Period for the iPhone, or Touch ID, Your Password and the Unlock Period for the Mac.
The launch lock¶
Require Face ID / Touch ID at Launch hides even your items' names until you unlock. Turning it off asks afresh, so someone holding your unlocked device can't simply switch it off.
On unless you turn it off. It applies when you open the app or come back to it, and to the splash screen after the Idle Timeout: 120 seconds with nothing touched unless you change it (10 to 300, or 0 for none).
Whenever you leave the app, whatever was open closes. Lock, the last entry of the menu, does the same at once.
Off unless you turn it on. It applies when you open the panel from the menu bar.
With it off, the lists show your items' names, websites and tags without asking; opening an item still asks.
An item closes by itself¶
Close After, in Settings under Item Screen, closes an open item after a number of seconds: 20 unless you change it, up to 300. While it counts down, the item's Pause button fills as the time runs out. Tap Pause to stop the countdown; the button becomes Done, which closes the item. Showing a password holds the countdown, and hiding it starts it again in full. With 0, an item stays open until you close it.
Not built yet.
Copying and the clipboard¶
A copy leaves your iPhone's clipboard after a time you choose in Settings under Copying:
| What you copy | Leaves the clipboard after | Can reach your other devices by Universal Clipboard |
|---|---|---|
| A password | 20 seconds (10 to 120) | Off unless you turn it on |
| A one-time code | 30 seconds (10 to 120) | On unless you turn it off |
| A hidden value, such as a card's number | 20 seconds (10 to 120) | On unless you turn it off |
| Everything else, such as a username | 30 seconds (10 to 300, or 0 for until you copy something else) | Never |
A copy that has reached your Mac or iPad stays there as long as Apple allows; Private Passwords can't clear another device. See Copying and the Clipboard.
A copy is cleared from your Mac's clipboard after 30 seconds, and a one-time code after 20, if it's still there. If you've copied something else since, that's left alone.
Every copy is marked as private, which tells clipboard-history apps not to keep it.
When the faces or fingers change¶
Anyone who knows your passcode (or your Mac's password) could add their own face or finger to your device, and then pass Face ID or Touch ID as you. Private Passwords watches for this. It compares the set of faces or fingers when it starts, each time it comes to the front, and before every check.
If the set has changed, the app locks for one hour: that's your time to erase a stolen device with Find My. Its screen, Face ID Has Changed or Touch ID Has Changed, says when you can unlock again. After the hour, Unlock asks for Face ID or Touch ID as it now stands, and records the new set. While the app is locked, AutoFill on the iPhone offers nothing.
No setting turns this off. A Mac without Touch ID isn't affected.
[Screenshot: the Face ID Has Changed screen]
Syncing between your devices¶
On your first launch, the Welcome asks where your items are kept:
- Sync via iCloud Keychain. Your items also appear in Private Passwords on your other iPhone, iPad or Mac signed in to the same Apple Account, with iCloud Keychain turned on. Apple does the syncing and encrypts it end to end; Private Passwords has no server in between.
- Keep on This Device Only (on the Mac, Keep on This Mac Only). Your items are never synced or moved anywhere by themselves. If the device is lost or replaced, only a backup you made earlier can bring them back.
Each item keeps the choice it was made with, so Settings shows your choice but can't change it. To change it, make a backup, use Delete All Data on the Info page, and the Welcome asks again.
Syncing happens only while iCloud Keychain is on: on the iPhone in the Settings app, on the Mac in System Settings, under your name, then iCloud, then Passwords & Keychain. Private Passwords can't tell whether it is.
What syncs with your items: your tags, Types and templates, the archive and Bin settings, Credential Health's daily count, and the pairs you told Merge never to suggest. What each device keeps for itself: the launch lock, the Unlock Period, Close After, the copying times and Manage Credential Health.
Your Apple Watch gets its items from your iPhone through Device Sync, over the paired connection, never through iCloud. See Codes on Your Apple Watch.
Continue to What the App Never Does.