Free audit tool
Password setup health check
A strong password you keep badly is a weak password. This checks the system around your logins: the manager, its own second factor, its recovery codes, the shadow copies. You get a graded checklist with the fixes that matter most first. It never asks for a password, and couldn’t use one if you typed it.
Audits your setup, never a password. Answers stay in your browser.
Six questions about your setup
Answer for your everyday logins: email, banking, the accounts that matter. No passwords, ever.
How do you keep track of your passwords?
The manager is the foundation. Everything else builds on it.
Your master passphrase, in concept, not the actual words
It’s the one key to the whole vault. We only ask about its shape, never the passphrase itself.
Don’t type it here or anywhere it isn’t the login box. Want to build a strong one, or see how long a given one survives? Use the linked tools below. Passphrase generator — build a strong master, honest math · PIN & password survival — how long would it hold?
Is 2FA turned on for the manager itself?
The vault holding every key deserves a second lock of its own. A stolen master password alone shouldn’t open it. Not all second factors are equal: some can’t be phished, some can.
Where do the manager’s OWN recovery codes live?
The kit that gets you back in if you lose the master password or your 2FA device. Most people never find out where it is until they’re locked out.
Is your browser ALSO saving passwords?
Browser-saved logins sitting behind nothing but an unlocked screen are a second, weaker copy of your vault, and the one attackers reach first.
If you lost your phone right now, could you get back in?
A vault only your phone can open is one drop in a lake away from locking you out of everything at once.
Your setup health
The checklist
Fixes, ordered by impact
Nothing flagged. Every part of your setup came back solid. Re-run it after any big change.
How this works (and what it refuses to know)
Six questions map the shape of your setup, nothing more. There is no text input anywhere on this page. It cannot receive a password, a master passphrase, a recovery code, or an account name, because there is nowhere to put one. Grading runs in your browser against fixed, published rules (src/data/password-health.ts). The fixes are ordered by the impact of the gap they close, so the top of the list is where an attacker would start. Your answers are saved only in this browser’s localStorage so you can come back. Nothing is ever sent. This is general guidance, not a substitute for your manager’s own security docs.
The manager holds the passwords. What holds the manager?
Recovery kits, 2FA backups, the codes that get you back in: the things too sensitive for a synced note and too important to lose. Sealby keeps them encrypted on your iPhone. No account to phish, nothing readable to steal.
iPhone & iPad · iOS 17+ · Free