Question 1

Do I need an account to use the tools?

Accepted Answer

No. Every browser-only tool — password and passphrase generators, hashing, checksums, QR codes, and file encryption — works without signing in, because the work happens on your device. An account is only needed for anything that syncs, such as the vault, notes, and incident log.

Question 2

What makes this different from a normal password manager?

Accepted Answer

The vault is one module among many. SYNTHESIS CYBER also covers the things people actually get caught by: recognising scams, hardening devices, verifying downloads, and documenting incidents properly. It is a security workspace rather than a single-purpose tool.

Question 3

Is there a free plan?

Accepted Answer

Yes, and it is not a trial. The Free plan includes unlimited use of all browser-only tools, a 25-item encrypted vault, 50 MB of encrypted storage, and full access to the Cyber Academy.

Question 4

Can you read my vault?

Accepted Answer

No. Vault items are encrypted with AES-256-GCM using a key derived from your master password on your device. We receive and store ciphertext. We do not hold your key and cannot decrypt the content, including under legal compulsion.

Question 5

What happens if I forget my master password?

Accepted Answer

The encrypted content becomes permanently unrecoverable unless you have your recovery kit. This is the direct consequence of a zero-knowledge design — we cannot reset something we cannot read. We prompt you to download and store a recovery kit when you first set up the vault.

Question 6

What data do you actually hold about me?

Accepted Answer

Your email address, display name, password hash, plan status, authentication factors, and operational metadata such as item counts, storage totals, and security event timestamps. Product analytics are collected only if you consent, and are aggregated.

Question 7

Do you sell data or run ads?

Accepted Answer

No, and we do not use advertising or cross-site tracking technologies at all. Revenue comes from subscriptions only.

Question 8

Have you been independently audited?

Accepted Answer

We publish our security architecture, encryption model, and penetration test summaries in the Trust Center, and we state honestly where formal certification is still in progress rather than implying accreditation we do not hold.

Question 9

Which two-factor methods do you support?

Accepted Answer

Time-based one-time passwords from any authenticator app, with recovery codes issued at enrolment. Passkeys are supported where your browser and device allow, and hardware security keys work through the same WebAuthn path.

Question 10

Can I see and revoke my active sessions?

Accepted Answer

Yes. Settings, Security lists every active session with device, browser, approximate location, and last activity, and lets you revoke any one of them or sign out everywhere at once.

Question 11

Do you support single sign-on?

Accepted Answer

SAML single sign-on and SCIM provisioning are available on the Enterprise plan.

Question 12

Do trials require a card?

Accepted Answer

No. Pro and Business trials start without a payment method and do not convert automatically. If you take no action, the account reverts to Free.

Question 13

Can I pay in Indian rupees?

Accepted Answer

Yes. Razorpay handles UPI, netbanking, and cards for customers in India, with GST applied and shown on the invoice. Stripe handles international card payments.

Question 14

How do refunds work?

Accepted Answer

New subscriptions are fully refundable within 14 days, no reason required. Annual renewals are refundable within 14 days if the paid features were not substantially used. Full details are in the Refund Policy.

Question 15

Does it work offline?

Accepted Answer

The application installs as a PWA. Browser-only tools work fully offline, and vault items you have opened are available from encrypted local storage. Changes made offline are queued and synced when you reconnect.

Question 16

Is there an API?

Accepted Answer

A documented REST API with key-based authentication is available on Business and Enterprise plans, along with configurable outbound webhooks.

Question 17

How do I report a vulnerability?

Accepted Answer

Through the form in the Trust Center or by emailing security@synthesiscyber.app. We acknowledge within two business days and will not pursue legal action against good-faith research conducted under our Responsible Disclosure Policy.

Questions people actually ask

Getting started

Security and privacy

Accounts and access

Billing

Platform

Still unanswered?