Questions, answered

Novash is a password manager for iPhone and iPad. It keeps your logins, passkeys, cards, notes, and more in a vault that is encrypted on your device. You unlock it with your master password, or with Face ID or Touch ID.

Novash needs a subscription, sold by Apple through the App Store. The price, any free trial, and when it renews are always shown in the app before you confirm. You can cancel at any time in your Apple account settings.

Your vault stays yours. You can still open it, view and copy what you saved, and export it. Adding and editing items, AutoFill, passkeys, authenticator codes, and the other subscriber features need an active subscription.

Yes. Export a CSV file from your current password manager or browser, then import it in Novash. Files from the popular ones are recognized automatically. Delete the CSV file afterwards, because it is not encrypted.

No. Your vault is encrypted on your device before it syncs, and we never have your master password or your recovery key, the only two ways to open it. We store only the encrypted copy. A few details, such as each item’s type and dates, are stored unencrypted so your vault can sync; the Privacy Policy lists them all.

AES-256-GCM for every vault item, and Argon2id with 64 MiB of memory and 4 passes to turn your master password into a key. Both run on your device. The Security page explains the details.

An attacker would find encrypted vault data they cannot read without your master password or recovery key. Novash’s slow Argon2id settings make every guess costly, and a strong, unique master password is what keeps it that way.

No. Novash is paid for by subscription. We do not sell personal data, show ads, or track you across other companies’ apps and websites.

Email security@novash.app. Our Vulnerability Disclosure Policy explains what to include and the safe harbor we give to good-faith research. Never include a real master password or recovery key.

Every change is encrypted on your device first, then synced. Your other devices download the encrypted copy and open it locally after you unlock.

Yes. You can export your vault at any time after confirming your master password, and protect the file with a password of its own. A file exported without one is not encrypted, so keep it somewhere safe.

It moves to the trash, where you can restore it for 30 days. After that it is deleted permanently.

Use your recovery key to open your vault and set a new master password. We cannot reset it for you, because we never have it. If you lose both your master password and your recovery key, the vault cannot be recovered by anyone.

Because a company that can open your vault for you could also open it without you. Novash is built so that only you hold the keys.

Yes. Every new sign-in needs a second step: a code sent to your email, or a code from your authenticator app if you turn one on.

In the app, go to Settings, then Account Information, then Delete account. Your account is erased 30 days later. To cancel, sign in before then and tap Cancel deletion. The Delete Your Account page has the full steps.

iPhone and iPad, through the App Store.

Yes. Sign in on each device and your vault stays in sync. You can see every signed-in device in the app and sign any of them out.

Sign in on another device and sign the lost one out from your device list. If you think someone may know your master password, change it. Once Novash locks, the vault on that device cannot be opened without your master password, Face ID, or Touch ID.