Accounts, sync and recovery key

One Halo account keeps your passwords, bookmarks, history and settings in sync, end to end encrypted.

What syncs

Your vault (logins, cards, notes, aliases, one-time codes, SSH hosts and keys), bookmarks, history, pinned tabs and settings sync between every device signed in to your account. Open tabs are restored on the same device only, encrypted with your account key.

How your data stays private

• There is no password. You sign in with a 6-digit code sent to your email, or with Google. Both reach the same account for the same address. Codes expire after 10 minutes, are stored only as hashes and are rate limited.
• A random 32-byte account key encrypts every synced record with XChaCha20-Poly1305 on your device. The server rejects anything that is not encrypted.
• The account key never reaches Synquic. Each signed-in device keeps it in the system keychain.
• The server stores only ciphertext and keys it cannot open: your public key, your private key encrypted with the account key, and a copy of the account key that only your recovery key can open.
• When two devices change the same data, Halo merges the other device's copy and tries again, so nothing is overwritten silently.

The security summary has the full design.

Your recovery key

Halo shows a recovery key once, when you create your account. It is 32 random bytes written as a HALO- code with a checksum. Keep it offline or in a password manager. It opens the encrypted copy of your account key that Synquic keeps, so a new device can read your data when no signed-in device can approve it.

If you lose every signed-in device and the recovery key, your encrypted data cannot be recovered. Synquic cannot reset it.

Open Halo on a new device

1. On the new device, sign in with your email and a 6-digit code, or with Google.
2. Open Halo on a device that is already signed in and choose Approve. Both screens show the same 6-digit code; check that they match. Your account key is sealed to the new device, so Synquic only passes along a box it cannot open.
3. No signed-in device? Choose Use recovery key on the new device and enter your recovery key. If your account was made with a master password before passwordless sign-in, you can also choose Use master password.

Make a new recovery key

In Settings, You and Halo, choose Create a new recovery key. Your previous recovery key stops working.

Stay signed in

After you first sign in on a device, Halo keeps your account key protected by the system keychain (the macOS Keychain or Windows DPAPI), so it opens without asking you to type anything. Halo uses it only if it opens this device's own vault; otherwise it asks you to approve the device or use your recovery key.

On Macs with Touch ID, Lock vault in the menu and auto-lock lock Halo until you confirm with Touch ID.

Devices and signing out

Settings, You and Halo shows the account you are signed in to, a Sync now button and your devices. You can sign out a single device or every device at once. Sessions use short-lived access tokens and rotating refresh tokens kept only in Halo's main process.