Passwordless Backup

twonly lets you recover your account without ever setting a password. Your private key is split into several parts and distributed to contacts selected by you. Recovering access only requires gathering a minimum number of those parts back, without having to remember a password.

Setup

Done once inside the app:

1. Go to Settings > Backup > Passwordless Backup.
2. Select trusted contacts: Choose a few friends. They will each hold one fragment of your encrypted key.
3. Add a second factor: Enter a PIN or an email address. This protects against your contacts collaborating without your knowledge.
4. Done: The app splits and distributes the fragments automatically in the background.

Recovery

If you lose access to your account (e.g. new phone):

1. Request fragments: Show a QR code or share a recovery link with your trusted contacts.
2. Contacts confirm: Each contact taps "Confirm" to send their fragment back to you.
3. Verify the second factor: Enter your PIN or use your email to complete the recovery.

What the server sees

The server never has access to your private key. It does not store your PIN or email in plaintext. Only in case of recovery the server can shortly see your email address, which is directly deleted after the email is sent.

Learn More

For a detailed technical description of how the protocol works, read the blog post.