Frequently Asked Questions

Extremely secure! Your data is encrypted directly in your browser using AES-256 encryption (the same standard used by banks and governments) before it ever reaches our servers. This means we literally cannot see your passwords, notes, or any other information you store. Even if someone hacked our servers, they would find nothing but useless encrypted data without your master password.

Unfortunately, there's no way to recover your data without your master password. This may sound harsh, but it's actually what makes Hexbon so secure — if we could recover your data, so could hackers. We strongly recommend: 1) Write down your master password and keep it somewhere safe (like a physical notebook in a secure location), 2) Set up regular email backups so you always have a copy of your encrypted data, and 3) Consider using a memorable passphrase instead of a random password.

Absolutely! Go to your Account Settings and change it whenever you like. When you do, all your data gets re-encrypted with your new password right in your browser. The process is seamless and your data stays protected throughout.

Our decryption tools are 100% open source and available on GitHub. You (or any security expert) can verify exactly how your data gets encrypted and decrypted. We believe in transparency — no secret sauce or hidden code. The tools run entirely in your browser, which means your sensitive data never touches our servers during encryption or decryption.

Nope! We have a zero-tracking policy. No Google Analytics, no Facebook Pixel, no Hotjar — nothing watching what you do. We don't serve ads and never share or sell your data to anyone. The only logs we keep are basic server access logs for security monitoring (like detecting attacks), and those don't contain any of your personal data.

Anything text-based that you want to keep private and organised! Common uses include:

• Passwords — Website logins, app passwords, WiFi passwords
• 2FA codes — TOTP secrets for two-factor authentication
• Secure notes — Private thoughts, recovery phrases, licence keys
• Addresses — Delivery addresses, contact details
• API keys — Developer credentials, secret tokens

Yes! Hexbon has a built-in 2FA/TOTP code generator. When setting up two-factor authentication for any account, just paste your TOTP secret and Hexbon will generate the 6-digit codes for you. No need for a separate authenticator app like Google Authenticator or Authy — everything stays in one secure, encrypted place. Plus, unlike phone-based authenticators, you'll never lose access to your 2FA codes if you lose your phone.

Yes! When adding a password field, click the generator icon to instantly create a strong, random password. You can customise the length (8-128 characters) and choose to include uppercase, lowercase, numbers, and symbols. We also offer a free online password generator that anyone can use — no account required.

Yes! For developers, we offer a free UUID generator that creates universally unique identifiers in v1, v4, and v7 formats. Great for database primary keys, API identifiers, or any project needing unique IDs. Like all our tools, it's completely free without registration.

Need to share a password with a colleague or family member? Hexbon lets you securely share any data with three options:

• Single-view access — The link self-destructs after the recipient views it once. Perfect for sending sensitive credentials.
• Expiry date — The link expires after your chosen time period (from 15 minutes to 30 days). Good for temporary access.
• Permanent links — The link stays active until you manually revoke it. Useful for ongoing shared access.

Here's the clever bit: shared data is encrypted with a completely new key — not your master password. You send the recipient the link, then tell them the decryption key separately (via SMS, a call, or in person). This way, even if someone intercepts the link, they can't read the data without the key.

Think of snapshots as "undo" points for your vault. Hexbon stores up to 3 snapshots: one you can create manually anytime, and two automatic ones saved before you make changes. Accidentally deleted some important passwords? Made a mess while reorganising? Just restore from a snapshot and everything's back. It's your safety net against mistakes.

Yes! We've built multiple redundancy options so you're never locked out of your own data:

• Email backups — Regularly receive your encrypted data via email
• Mirror sites — Our decryption tools are hosted on Cloudflare, Vercel, and GitHub
• Self-hosting — Download the decryption tools and run them on your own computer

The free plan gives you 1 MB of storage, which is more than enough for most people. To put that in perspective, 1 MB can hold roughly 500-1000 password entries (depending on how many notes you add). For the average person storing passwords, a few bank cards, and some notes, you'll likely never hit the limit.

We support 8 popular OAuth providers: Google, Microsoft, Facebook, X (Twitter), LinkedIn, Discord, Yahoo, and GitHub. Just click your preferred provider and you're in — no need to create yet another password to remember! Your data is protected by your master password, which is separate from your login method.

Go to Account Settings and click "Delete Account". Your data will be permanently erased from our servers immediately — no 30-day waiting period, no hidden backups. Before we delete everything, we'll email you a copy of your encrypted data so you can access it later using our open-source tools if you change your mind. Once deleted, it's truly gone on our end.

Got a question or ran into a problem? Drop us a message through our contact form and we'll get back to you as soon as possible. We read every message personally.