🔐 Password vault

All your passwords in one encrypted file – you only need to remember a single one.

What it does for you

• A separate, strong password for every service – without having to remember any of them.
• If an online shop is hacked, your other accounts are not at risk.
• Your passwords are available on all your devices, but readable for nobody else – not even us.

Who it is for: Everyone. Those who reuse passwords today, save them in the browser or write them on notes benefit most.
What you need: A good master password that you never forget. About 5 minutes. Included in your account.

E-mail, bank, online shop, health insurance, streaming, Wi-Fi: most people have over fifty logins – and three passwords for them. If one of them is stolen at some shop, criminals automatically try it everywhere. The vault solves this: every account gets its own random password, and you only remember one.

How it works

The vault is a single file containing all your login details – website, user name, password, notes. This file is encrypted with your master password. Without it, it is just gibberish. Compare it with a safe: inside are all the keys to the house, and you only need the combination for the safe.

The encryption happens on your computer before the file is uploaded to your storage. Our server only sees the encrypted file. DasDing uses the open KeePass format for this (file extension .kdbx). So you can also open the same file with free programs like KeePassXC on the PC or Keepass2Android or Strongbox on the phone – you are not tied to DasDing.

Warning

without the master password the data is lost. We can't open the vault either – that is exactly what makes it secure. So choose a password you won't forget, and print the vault emergency sheet (see below).

Creating

1. 🏠 Personal area → 🔐 Passwords.
2. Choose a master password: at least 10 characters, ideally a whole sentence. The indicator shows you how strong it is.
3. Optionally a key file (“Create new …”): a second key that is needed in addition to the password. Not necessary for most people. If you do use one: don't save it in the DasDing folder, and put a copy on a USB stick. Never choose a KeePass file (.kdbx) as key file – it changes with every save, and afterwards the key no longer fits. DasDing therefore refuses it.
4. Tick “I understand …” → Create vault.
5. Print the 🖨 Vault emergency sheet and keep it at home. It says where the file is and how to open it without DasDing – important for relatives in an emergency, too.

Already have a KeePass file? Then use “Import existing KeePass file …”.

Using it

• ＋ Entry: title, user name, password, address, notes. With 🎲 DasDing generates a random, strong password – simply click “Use”.
• 👤 copies the user name, 🔑 the password. You then paste it on the website with Ctrl+V. The clipboard is cleared automatically after 30 seconds.
• Groups organise the entries (for example “Private”, “Work”). DasDing creates the group “SSH” itself.
• 🔒 Lock or just wait: after 20 minutes without using the program, the vault locks itself – even if the window is minimised. Switching tabs does not lock. SSH access, mail and integrations lock together with the vault.

2FA codes (authenticator)

Many services offer two-factor sign-in with a 6-digit code. Instead of a separate authenticator app you can use the vault: switch to 🔢 2FA codes at the top (on the phone 🔢 Codes) → ＋ Add 2FA code.

• On the phone: 📷 Scan QR code and point the camera at the QR code the service shows during setup.
• On the PC: choose 🖼 QR code from image … or paste a screenshot of the QR code with Ctrl+V.
• Or type in the key shown by the service.

The code then appears with a small ring showing the seconds left. Tap it to copy (the clipboard is cleared after 30 seconds). The advantage over a phone app: the codes are stored encrypted in the vault and are on all your devices – if your phone is lost or broken, the new phone has all codes again right after signing in. 2FA keys from Integrations appear here too.

The codes depend on the time. DasDing calculates them with the server's clock – if your device's clock is off, a notice appears at the top; then set it right (Windows: Settings → Time & language → Date & time → Sync now).

TIP

Important: the code for signing in to DasDing itself belongs in an authenticator app on another device, not in the DasDing vault – otherwise the account protects itself. DasDing therefore refuses this key.

Isn't that less secure than a separate app?

Password and code are then in the same encrypted vault – protected by your master password. Whoever had both your master password and your file would have both. For most people the gain is bigger: codes are no longer lost when changing phones. If you want maximum separation, keep especially important codes (e.g. your bank) in a separate app.

Import from another app

With ⤓ Import you bring over all codes from your previous app at once:

• Google Authenticator: in the app ⋮ → Transfer accounts → Export accounts. On the phone, scan the QR code with 📷 Scan export QR code (only from a second device – Google blocks screenshots). On the PC, take a photo of the QR code and choose the photo. With many accounts Google shows several QR codes – read them all one after another.
• Aegis: Settings → Import & Export → Export. Encrypted exports work too; DasDing then asks for the export password.
• 2FAS: Settings → 2FAS Backup → Export backup file (with or without password).
• andOTP, FreeOTP+, Bitwarden (.json), Ente, Proton: choose an unencrypted export.
• Authy, Microsoft Authenticator: offer no export. Set up two-factor sign-in again at each service.

Before importing you see the list; codes already in the vault are unticked. Afterwards delete the export file – it contains your keys. Remove the codes from the old app only after a sign-in with DasDing has worked.

Imported the wrong ones? With ☑ Select (at the top of the list) you tick several codes – or All – and remove them at once with 🗑 Remove …. Then simply import again.

Safety: nothing gets lost

Your vault is protected several times over:

• Checked saving: DasDing checks every change before it replaces the file on the server. If the connection drops, the old file stays intact.
• Not saved? If the red bar “The last change is not on the server yet” appears, the change is kept encrypted on your device. Save again – or automatically at the next unlock – adds it.
• Backups: daily on the first save and before every sync, restore or password change. Kept: the 10 newest, one per day (30 days) and one per month (12 months).
• Deleted stays deleted: an entry deleted for good does not come back via another device. Deleted mail and integration logins go to the trash first.

Restoring

🕘 Backups (at the top of the vault) shows all backups.

• Missing entries … lists what is in the backup but missing from the vault (for example deleted by mistake). Tick them → Restore. Everything else stays as it is.
• Replace vault … sets the whole vault to the state of the backup. The current state is backed up first – so this can be undone too.
• If the vault can't be opened at all, this also works in the locked view: enter the master password → 🕘 Restore from backup ….

Password is right, but the vault won't open

Usually a file was chosen as key file earlier – sometimes by mistake, for example the KeePass file itself. If that file changes or is gone, the key no longer fits. This is how you get back in (in the locked view):

1. 🔍 Find key … → enter the master password → ＋ Choose files … (on the PC also ＋ Choose a whole folder …): all KeePass files you have – including old copies and downloads. DasDing also checks the files in your vault folder and all backups by itself.
2. 🔍 Search. Each file takes about a second. If one fits, the vault is open.
3. Right away Stop using the key file – afterwards your master password is enough, on all devices.

Nothing found? Try the same on your other device. As a last resort on the PC: ⇪ Replace vault with a KeePass file … – the chosen KeePass file (for example the one that opens on the PC) becomes your vault. The previous one is kept as a backup.

On the phone, ↺ Reset on this phone … removes the fingerprint, a remembered key file and the copy on the phone; the vault on the server stays as it is.

Changing the master password and vault emergency sheet

🔑 Change password asks for the current and the new master password. If your vault has a key file, you can also choose “Stop using the key file” there. DasDing creates a backup first; afterwards the 🖨 Vault emergency sheet opens so you can print it again. On other devices you then unlock with the new password. You can print the emergency sheet at any time via 🖨 Emergency sheet.

Under 🔢 2FA codes → 🖨 Emergency list (on the PC) you print all 2FA keys with QR codes. With it you can set up your codes again in any authenticator app if phone and vault are ever out of reach. Keep it like cash.

Unlock with fingerprint (Android)

On the phone you can also open the vault with your fingerprint: in the open vault 👆 Fingerprint → enter the master password to confirm → Turn on and touch the sensor. From then on unlocking shows the fingerprint prompt right away; Master password always takes you to the usual way.

• The master password is kept encrypted in the phone's security chip and is only released after a fingerprint – the phone PIN is not enough.
• Every fingerprint stored on the phone opens the vault. Only store your own.
• If a new fingerprint is added or you change the master password, the feature turns itself off – unlock once with the master password and turn it on again.
• Every 14 days the vault asks once for the master password. That keeps it in your head – you still need it on the PC and for a new phone.

How to switch over gradually

You don't have to change all your passwords in one day. What has proven itself: every time you sign in somewhere, add the login to the vault and take the opportunity to replace the password on the website with one generated by 🎲. Start with the most important ones: e-mail and bank.

Where is the file?

By default: /Persoenlich/Passwörter/DasDing-Tresor.kdbx in your personal area, so available on all your devices. Backups are created automatically under Passwörter/Sicherungen/. If you like, you can also use a file on the PC or in a VeraCrypt container via “📂 Use own KeePass file …” – it then only applies to this computer.

Isn't it dangerous to have all passwords in one place?

The place is encrypted and can only be opened with your master password. The risk of a reused password being stolen from a hacked shop is far greater. With two-factor sign-in turned on, nobody gets to the file in your storage either.

TIP

Important: the recovery codes of your two-factor sign-in belong on the vault emergency sheet (paper) – not only in the vault. Otherwise, without your phone, you can reach neither the account nor the vault.

---

This guide is also available in the program under 📖 Guides – with jump links to the other guides.