What the App Never Does¶
A short list of promises, every connection the app makes, and an honest list of what no app can promise.
Private Passwords never…¶
- sends your items to Pebble IT or anyone else. There's no Pebble IT server for them to go to. The only copies outside your device are the ones you choose to make: iCloud Keychain sync, backups, exports and your Apple Watch.
- asks you to create an account or sign in. There's no account.
- shows adverts, collects analytics or tracks what you do.
- shows a password without checking it's you: Face ID or Touch ID, or your passcode or Mac password where those can't be used. With Touch ID, a passcode or your Mac's password, one check lasts for the Unlock Period you set.
- keeps your backup's recovery key. It's shown once while you make the backup. The app doesn't keep it, and nobody, including Private Passwords, can recover it.
- asks for your photo library, contacts, location or microphone. When you choose a picture, the system hands over only the one you chose.
- uses the camera for anything but reading the QR code of a one-time code.
What it connects to¶
Private Passwords makes only these connections:
| What | When | What leaves your device |
|---|---|---|
| An item's own website, for its icon | See below | A request for the site's front page and the picture it names, like the one a browser makes. The site learns only that someone asked for its icon. |
| The public lists of which sites offer MFA and passkeys | iPhone only: at most once a month, while Credential Health and Check What Sites Offer are on | Nothing of yours. Each list is fetched whole and matched against your sites on the iPhone. |
| Apple's iCloud Keychain | If you chose to sync | Your items, which Apple encrypts end to end. Apple does the syncing, not Private Passwords. |
| Your Apple Watch | With Device Sync on | Items holding a one-time code, sealed so that only your Watch can open them, sent over the iPhone's paired connection, never through iCloud. |
Asking for icons, in more detail:
With Icons from Sites on, in Settings under Icons, an item's own site is asked for its icon, and nobody else: when you press Site in an item's editor, when you choose Bring Site Icons on the Info page, and once when an item is saved with a new site and no icon. It's on unless you turn it off. Off, no site is ever asked, and the icons you have stay.
Private Passwords itself has no access to the network at all. A small helper inside it asks the site, and the helper can't read your items: only a site's name, or a picture you chose for an item, goes in, and only a small picture comes out. With Icons from sites on, a switch on the Info page, a site is asked when you choose Bring Site Icons there, and once when an item is saved with a new site and no icon. It's on unless you turn it off.
The Mac never fetches the lists of what sites offer: it shows what your iPhone found, when your items sync.
Every request for an icon uses an encrypted connection, sends no cookies and keeps nothing afterwards. No icon service is ever used, since one would be handed the list of your sites.
Some links open a website in your browser when you choose them: an item's site with Open Site, and Pebble IT's website and this documentation from the Info page. Private Passwords hands the address to your browser and nothing more.
The permissions it asks for¶
| Permission | When | Why |
|---|---|---|
| Camera | The first time you scan a QR code | To read the QR code of a one-time code |
| Face ID | The first time you need it | To check it's you |
| Permission | When | Why |
|---|---|---|
| Camera | The first time you scan a QR code with it | To read the QR code of a one-time code |
Everything else, such as the photo picker and choosing a file, is provided by the system and needs no permission of its own.
What no app can promise¶
- If your device is unlocked and the launch lock is off, whoever holds it can see your items' names, websites and tags (not their passwords).
- If your device is jailbroken or otherwise compromised, software running on it can read what the app reads. The Keychain and Face ID or Touch ID protect a device that hasn't been tampered with.
- A backup is as safe as its recovery key. Anyone who has both the file and the key can restore your items.
- An export file holds your passwords in plain text. Anyone who has the file can read them. Save it only where you must, and delete it once it has served.
- A password on screen is a password on screen. If you read it out, or type it into a fake website, the app can't help.
- The websites you sign in to have their own weaknesses. A strong, unique password and MFA make your logins much harder to steal; they don't make the website itself secure.
The Privacy Policy puts this in writing.
Continue to If You Lose Your iPhone or Mac.