The hardest part of using a password manager is the first ten minutes.
Most apps drop you into a feature-rich, decision-heavy interface and expect you to figure it out. Pick a master password, with no help on what makes a good one. Decide whether to enable biometrics, with no explanation of what gets stored where. Name a vault. Choose which cloud to sync to. Then add a credential, set up two-factor auth, configure auto-lock and clipboard timeout, connect a browser extension, pick recovery options.
Those decisions all matter. The problem is that asking someone to make every one of them in the first session is the surest way to create an abandoned vault.
In v3.0.0, SecureKeep ships a 6-step first-run wizard that does the opposite. It's opinionated where it can safely be and optional everywhere else, and it's aimed at one particular person: the household digital steward, who is usually setting this up for a whole family over time, their own accounts first, then a spouse's, a parent's, and eventually the kids'. Six steps, three of them skippable, and about six minutes of real attention.
Here's what each step does, and why we built it that way.
Step 1: Name your vault
The wizard opens by asking what to call this vault. There's no generic "Welcome to SecureKeep" splash and no tour of features, just a specific question: whose vault is this?
The default suggestion is "My Vault." A first-time user can accept it and move on. A user setting up a family-of-four arrangement might type "Mum's Vault" or "Aarav's Vault" or "Joint Household."
This is intentional. SecureKeep's multi-vault model treats each vault as belonging to a person. A household digital steward will eventually keep several on one device: one for themselves, one for an aging parent, one for a child's school accounts. Naming the first vault properly sets that mental model from the start.
You can rename a vault later (Settings → Vault → Rename). The first-run name isn't permanent.
Step 2: Choose a master password
This is the most consequential step in the whole setup. The master password is the only key into the vault, and it isn't stored anywhere: only a verification token derived from it lives on the device, and the actual encryption key exists only in memory while the vault is unlocked.
Most setup wizards either accept whatever you type, or apply a binary "is it 8 characters?" check that's barely better than nothing. SecureKeep's wizard runs zxcvbn (Dropbox's open-source password strength estimator) on whatever you type, in real time, and shows you a strength score from 0 to 4. You can't proceed below score 2.
Why zxcvbn instead of a character-count rule? Because Password123! passes any character-count check and fails zxcvbn instantly: it's a top-100 password with a predictable suffix. Real strength comes from entropy, not surface complexity, and zxcvbn measures it properly.
The wizard also asks you to confirm the password by typing it twice. There's no "show password" toggle on this screen, because we don't want a master password ending up in autocomplete, a screen recording, or a screenshot someone takes while helping a parent set up their vault.
A note on what to choose: a four-word passphrase ("garden bicycle stove forest") scores well, is memorable, and is easy to type even on a phone keyboard. We recommend that pattern explicitly. The wizard's strength meter will agree.
Step 3: Biometrics, optional
If your device supports Face ID, Touch ID, or fingerprint authentication, the wizard offers to enable biometric unlock for this vault. The choice is yours.
The tradeoff:
- With biometrics on, the data encryption key is stored in iOS Keychain (or Android Keystore) protected by biometric authentication. Day-to-day unlock takes a glance or a touch. The master password remains a fallback.
- With biometrics off, every unlock requires the master password. Slower, more friction, marginally fewer attack surfaces.
The wizard is upfront about this. "Skip biometrics for now" is a first-class button, not a hidden option, and you can turn biometrics on or off later from Settings.
This step is also where the vault gets created. When you tap Create Vault, several things happen at once:
- A 256-bit data encryption key (DEK) is generated using the OS's cryptographically secure random number generator (
expo-crypto). - A random salt is generated. Your master password plus the salt is fed through PBKDF2-SHA256 at 600,000 iterations to produce a derived key.
- The derived key wraps the DEK using AES-256-GCM. The wrapped DEK is what's stored on disk.
- A verification token is created so the vault can confirm a future master-password attempt without storing the password itself.
- The vault file structure is initialized in the device's encrypted SQLite database.
If biometrics are enabled, the DEK is also stored in iOS Keychain or Android Keystore with requireAuthentication: true. Otherwise it's only ever derived from your master password at unlock time.
This is the moment the vault becomes a real thing. Everything before this step was preparation.
Step 4: Add your first password (skippable)
The wizard offers to add your first credential here, less as homework than as a chance to actually try the thing you came to do.
If you accept, you go through the same Add Credential flow the rest of the app uses: label, username, password (with the generator one tap away), URL, and optional fields. The wizard waits, watches you save the credential, and advances when you do. If you back out instead, nothing punishes you: no penalty, no "are you sure?" prompt, no progress bar judging you for skipping.
If you skip, the vault is still fully functional. You can add credentials any time from the dashboard.
The reason this step exists is empirical: users who add even one credential during setup come back the next day at roughly twice the rate of those who don't. What drives that is the act of adding one itself, which turns an abstract idea ("I'm using a password manager now") into something concrete ("I just added my Gmail password and watched it get encrypted"). The specific credential barely matters.
We don't force this. But we make it the path of least resistance.
Step 5: Create your first backup (skippable)
Step 5 is the one most setup wizards omit entirely.
A local-only password manager has exactly one way to lose access to your vault: losing the device. Cloud-synced products handle that with sync, since your vault also lives on three other devices. SecureKeep handles it with encrypted backup files instead.
The wizard prompts you to create your first backup at the moment you have the least in your vault. That's exactly when most people skip it ("I only have one password, why bother?"), and exactly when the habit of "this vault has a backup" is most worth building.
The backup is:
- A single
.securekeepfile. - Encrypted with a passphrase you choose at backup time (separate from your master password, and the screen explains why).
- Restorable on any device, on any version of SecureKeep.
- Yours to store wherever you like: iCloud Drive, Google Drive, a USB stick, a fireproof box, an email to yourself.
The wizard offers to share the backup file through the system share sheet (Files, AirDrop, email, iCloud Drive, Google Drive). Where it goes is up to you; we never see the file, and we'd rather not.
If you skip this step, the wizard doesn't nag; the backup feature is still there later under Settings → Backup. The wizard is just the moment the question lands most cleanly.
Step 6: You're ready
The final screen is short. It says, in effect: you're ready, and here's what to do next.
Three suggested next steps surface on this screen:
- Set up your Emergency Card: medical info, contacts, insurance, physician. The Emergency Card is the artifact most users open most often, and the screen says so.
- Import passwords from your old manager: the CSV import flow handles Chrome, Edge, Brave, Apple Passwords, LastPass, Bitwarden, 1Password, and Dashlane.
- Add another vault: for your spouse, your parent, or your child. Multi-vault is a core part of the product, not a hidden feature.
You tap Go to my vault and you're at the dashboard.
The wizard doesn't run again. A flag (setup_wizard_completed) is written to AsyncStorage, and any subsequent vault creation goes through the simpler vault-creation flow instead.
What the wizard doesn't do (and why)
A few things we deliberately left out of the wizard.
There's no tour of features. Tours are how products admit their UX is too complicated to be self-evident; the wizard just gets you to a usable vault and trusts the app to teach the rest by being usable.
There's no cloud-account creation, because there is no cloud account. SecureKeep has no server, so you don't sign up for anything. The vault on your phone is the whole product.
For the same reason, there's no "verify your email" step. There's no email on file to verify.
Nothing nags you about biometrics, backups, or your first credential. All three are skippable, all three are first-class buttons, and none of them hide a "no thanks" in small grey text at the bottom of the screen. We don't want dark patterns anywhere near the moment someone is deciding to trust us with their passwords.
And the progress meter doesn't punish skipping. It shows which step you're on, not whether you "completed" the wizard the way we wanted.
How long this actually takes
Roughly six minutes, in our usability testing, for the median user. Distribution looks something like:
- Naming the vault: 30 seconds
- Choosing a master password (the slow step): 60–120 seconds, depending on whether you have a passphrase pattern in mind
- Biometrics: 15 seconds (or skipped)
- First credential: 90 seconds (or skipped)
- First backup: 60–90 seconds (or skipped)
- Final screen: 15 seconds
Skipping every optional step ends the wizard in roughly 90 seconds. Doing every step ends it in roughly 6 minutes. Both paths produce a working, encrypted vault.
What the wizard is really after is respect for your time. It asks for no more attention than each step actually needs.
Frequently asked questions
Can I redo the setup wizard later? Not directly; the setup_wizard_completed flag is one-way. You can create additional vaults any time through the standard vault-creation flow, which has all the same steps without the wizard framing.
Does the wizard work the same on Android and iOS? Yes, the same six steps and the same skippable options on both. The biometrics step uses Touch ID or Face ID on iOS and the platform fingerprint API on Android.
What if I forget the master password I set during the wizard? If you have an encrypted backup file and remember the backup passphrase, you can restore it on a new device, though you'll still need the master password used at backup time. If the master password and every biometric path are gone and there's no backup, the vault content can't be recovered. That's the trade-off for a local-only architecture: we keep no server that could issue a password reset.
Can I create more than one vault during the wizard? No; the wizard creates exactly one vault. You add more later from the vault picker.
Is the wizard required for App Store / Play Store demo accounts? Demo Mode bypasses the wizard and lands directly on a pre-populated demo vault. The wizard is the path for real first-time users.
Can I import a CSV during the wizard? Step 4 ("Add your first password") is a single-credential flow. The bulk CSV import lives one tap away from the dashboard after setup. Many users skip Step 4 in the wizard and head directly to Settings → Tools → Import from CSV to bring in 200 passwords at once. Either path works.
What changed compared to v2 onboarding? v2 had a single combined "create vault" screen with all decisions on one page. v3.0.0 split it into the wizard so users could engage with each decision in turn, and so the optional steps (first credential, first backup) could be offered without cluttering the create-vault screen for users who already know what they're doing.
Related reading: