Protect: Password encryption

The password vault is encrypted using the AES-256-GCM algorithm, which uses a key. The AES-256 algorithm is considered reliable: the Department of Homeland Security in the USA recommends using it to protect Top Secret data.

However, even the most complex encryption algorithm will not protect your passwords if a hacker finds the encryption key. The master password lets you use very powerful encryption for the key.

To learn more about password encryption, see Password encryption in Yandex Browser.

Create a master password

1. Click   → Passwords and cards.
2. Click Settings.
3. Under Passwords and cards aren't encrypted, click Create master password.
4. If you use your account password on that computer, enter it in the system password dialog window.
5. Enter your master password, which should be at least 6 characters long. We recommend using passwords that are complex but easy to remember.
6. Then re-enter the password to confirm.
7. In order to restore access to your password vault if you forget your master password, create a backup encryption key.

Now saving website passwords in Yandex Browser and accessing your password manager will require entering your master password. The master password isn't saved on the computer or the server. Only a key encrypted with it is saved.

Change the master password

1. Click   → Passwords and cards.
2. Enter your current master password.
3. Click Settings.
4. In the Passwords and cards are encrypted section, click Change master password.
5. In the window that opens, enter your current master password.
6. Enter your new master password, which should be at least 6 characters long. We recommend using passwords that are complex but easy to remember.
7. Then enter it again to confirm.

After that, the key encrypted with the master password is re-encrypted and transferred to your other devices during the next syncing. The master password isn't saved on the computer or the server.

Delete master password

1. Click   → Passwords and cards.
2. Enter your current master password.
3. Click Settings.
4. In the Passwords and cards are encrypted section, click Delete master password.
5. In the window that opens, enter your master password to confirm.

After that, Yandex Browser will no longer request the master password to access passwords. During syncing, the master password will be deleted from other devices.

Frequency of master password requests

The browser requests your master password when you save new passwords, automatically insert passwords into an authorization form, or attempt to access your password vault. You can adjust the frequency of master password requests:

1. Click   → Passwords and cards.
2. Enter your current master password.
3. Click Settings.
4. In the Ask for master password to access saved passwords and bank cards field, select the frequency: after Yandex Browser is restarted; after the system has been logged out; once an hour; or every five minutes. The more frequently the browser requests your master password, the more secure your password vault is.
5. In the window that opens, enter your master password to confirm.

You can also disable master password requests. To do this, deselect the Ask master password to access saved passwords and bank cards option. After that, Yandex Browser will no longer request your master password to access your password vault. Additionally:

• Your master password is not deleted. It is recorded in the database in encrypted form. You encryption key is saved on your computer and protected by your operating system.
• Passwords saved earlier remain encrypted by the master password. When you save a new password or decrypt an old one, Yandex Browser uses your old master password without requesting it again.
• During syncing, all your passwords are encrypted and sent to your other devices. They will be used for login forms on these devices. To decrypt them, you will need to enter your master password.
• You have to disable master password requests on each of your devices manually. This enhances the security of your data: even if someone else gets access to one of your devices, they will not be able to use your passwords.

If you forget your master password

If you forget your master password and you have a recovery key:

1. When you're asked to enter your master password, click I forgot my password.
2. In the window that opens, select Reset master password. Click Continue.
3. Enter your new master password, which should be at least 6 characters long. We recommend using passwords that are complex but easy to remember.
4. Enter your new master password again to confirm. Click Continue.
5. On your Yandex ID page, enter your Yandex password.
6. After you do this, your master password will be updated and all passwords in your vault will be re-encrypted.

If you forgot your master password and don't have a backup encryption key, Yandex Browser will not be able to restore your passwords. It will no longer enter them into authorization forms, and you will not be able to view them in the manager. The only thing left will be to delete your passwords along with the encryption key. If you use a password for your computer account, you will need to enter it to confirm your access rights to delete your passwords.

If you forget your master password, you can only restore your passwords if you have a recovery key. To create one, you will need to enable syncing.

To change your master password, you will not only need a recovery key, but also a special file. It will be created automatically when you enter your master password for the first time and save it locally. That's why even Yandex can't decrypt your passwords.

To restore access, you must enter the password to your Yandex ID. The likelihood that a hacker could simultaneously steal the key from the server, the file from your device, and your Yandex ID password is very low.

To create a recovery key:

1. Click   → Passwords and cards.
2. Enter your current master password.
3. Open Settings.
4. In the Passwords and cards are encrypted section, click Enable master password reset.
5. Enter your current master password and click Continue.
6. In the window that opens, click Enable.

   Note. If Yandex Browser syncing was disabled, a window will appear on the screen where you can enable it. Enter your Yandex ID username and password and click Enable syncing.

The browser will tell you that a recovery key was created.

To delete it, go to your password manager settings and click Disable option to reset master password.