Multi-device Synchronization

The feature: same passwords vault on many devices

You have hundreds of passwords and multiple Macbook, iPhone, iPad, PC? Activate device synchronization. All your passwords on all your devices, with full security.

The model: a blind relay, not a cloud database

Most password managers sync by uploading your (encrypted) vault to a company’s cloud database. MyPwdTool works differently: there is no central database of vaults at all. Instead, your devices talk directly to each other through a small relay server whose only job is to pass encrypted messages along — it has no concept of a “vault,” a “password,” or even a “user account.”

The relay only ever sees:

• Random, pseudonymous device and inbox identifiers (no name, no email, no account tied to them)
• Opaque encrypted message blobs it cannot decrypt
• Enough routing metadata to deliver each message to the right device

It never sees, and structurally cannot see, the encryption key that would let it read any of those messages — because that key is generated on your own devices and exchanged directly between them, never through the relay at all (see below).

The relay’s source code is public and open for independent review at github.com/ThibaultDucray/e2eerelay — this is a deliberate design choice: you shouldn’t have to just take a vendor’s word for what their server does or doesn’t see.

Adding a device (pairing)

1. On a device already in your sync group, open Sync and choose “Add a device.” You get a QR code (and, on Apple platforms, a passkey-style handoff).
2. Scan that code on the new device.

The encryption key that protects your synced data is generated on your device and travels only through that direct QR exchange, hand-to-hand between your own devices. It never touches the relay. Once a device joins, it introduces itself to every other device already in the group, so a family of 3, 4, or 10 devices stays one fully-connected group — not a chain that breaks if one device happens to be offline.

Removing a device (revocation)

Revoking a device is designed to fail safe:

• It’s removed from your side immediately, even with no internet connection at that exact moment — your device simply stops sending it anything else, from that instant on.
• A brand-new encryption key is generated for everyone else in the group, and the old one is retired. Even someone who somehow extracted the old key from a stolen device gains nothing from it for any data moving afterward.
• If the removed device is still online and reachable, it receives the revocation, wipes its own local copy of the vault, and clears any saved unlock method — automatically. If it’s offline, that instruction waits for it for up to 30 days.
• A device that’s already been removed can’t be silently re-added by a stale, late-arriving message — every remaining device remembers it was removed and refuses to re-admit it.

The trade-off you should understand

A relay that can’t read your data also can’t recover it for you. If you lose every device that holds a copy of your vault, with no separate backup, that data is gone for good — see Local Vaults & Backups for exactly what that means and how to protect yourself against it (short version: keep an encrypted backup export somewhere separate from your devices).

One invitation per device isn’t paid for

Creating a sync group is a paid feature (see Subscription & Pricing). Joining an existing group is free on every platform. To keep that free-to-join design from being used to indefinitely propagate access without anyone paying for it, a device without an active subscription — which today means every Windows device, since Windows has no purchase option at all — can invite exactly one further device per vault before it needs to hand that job back to a subscribed device. This is a soft limit enforced by the app itself, not the relay, and doesn’t affect ongoing sync in any way once devices are already paired.