Schweizerform has two separate locks. Signing in gets you into your account. Your Vault key opens your encrypted responses. They do different jobs, and neither can stand in for the other.
| **Signing in** | **Vault key** | |
|---|---|---|
| Job | Gets you into your account | Unlocks your encrypted responses |
| How | A 6-digit code we e-mail you — or your password, if you set one | A passphrase you choose, typed in your browser |
| Who verifies it | Our server (a code works once, for 10 minutes; a password is stored only as a protected hash) | Only your browser — it never leaves your device |
| If forgotten | Nothing to remember for the code — just request a new one. A password is reset by e-mail code | Restore with your recovery code (8.3) |
| If we're asked for it | We couldn't tell anyone — codes are single-use and a password is stored only as a hash | We couldn't either — we never had it |
Why two keys? Because they protect against different things. Signing in keeps strangers out of your account. The Vault key keeps everyone — including us, including anyone who ever breached a server — out of your data. Your e-mail lets you in; only your Vault key opens your data. Someone who gets into your mailbox, or learns your password, still cannot read your responses.
Do I need a password?
No. New accounts sign in with a code we e-mail to you — there is no password to create or remember. A sign-in lasts up to 30 days on each device, so you won't need a code every day. If you prefer a password, add one in Settings → Security (Set a password), or through Forgot password? on the sign-in page. It is then an extra way in; e-mail codes keep working. Accounts that already have a password keep it and can use either.
Tip
If you set a password, make it genuinely different from your Vault key. Both can live in your password manager: Schweizerform labels them so your browser saves them as two separate entries — the Vault key one shows (Vault key) after your e-mail. Keep your recovery code somewhere else, such as printed in a folder, so one lost device never takes both.