Code? Zack.

Two-Factor Authentication (2FA) adds a second step to your login – usually a 6-digit code that changes every 30 seconds. TOTP stands for Time-based One-Time Password. It's the standard behind Google Authenticator, Microsoft Authenticator, Authy, and others. Zack generates these exact same codes – right in your Mac's menu bar and on your iPhone or iPad. SHA1, SHA256 and SHA512, 6 or 8 digits and custom periods are supported.

Yes, it is. The whole point of 2FA is that the second factor lives on a separate device – compromising two devices is much harder than one. Zack puts both factors on the same machine, which genuinely weakens that protection. That's why we recommend not using Zack for banking, crypto, or your primary email. That said: many people skip 2FA entirely because it's too annoying. Having your codes on your Mac is less secure than having them on a separate phone, but infinitely more secure than not having 2FA at all.

Zack's vault key is stored in the device Keychain, which is protected by your login password, and you can additionally lock Zack with Touch ID or your device password. Your synced entries are stored on our servers only in encrypted form. Keep your critical accounts on a separate device anyway – Zack is meant for your daily, lower-risk logins.

$5/month or $40/year (save 33%). Both plans include all features and updates, and one subscription unlocks Zack on all devices signed in to your account. On the Mac you pay through Stripe; on iPhone and iPad through the App Store, where prices are shown in your local currency and may differ slightly.

Yes, anytime. If you subscribed on the Mac, use “Manage Billing” in the app. If you subscribed on iPhone or iPad, cancel in your Apple ID subscription settings (Settings › your name › Subscriptions). You keep access until the end of your current billing period.

Any service that supports TOTP-based 2FA – which is almost all of them. GitHub, Google, AWS, Discord, Slack, Notion, Figma, WordPress, Jira, Cloudflare, Stripe, you name it. If it shows you a QR code when setting up 2FA, Zack can scan it.

Absolutely. When you set up 2FA on a service, scan the QR code with both your existing authenticator and Zack. They'll generate identical codes.

Every entry is encrypted on your device with AES-256-GCM before it is synced through our servers. We only ever store ciphertext and can't read your secrets, account names or codes. To set up a new device, either scan a QR code shown on a device that's already unlocked, or enter your recovery passphrase.

As long as one of your devices is still unlocked, you can set up new devices from it via QR code. If you opted in, your passphrase is also backed up in your own iCloud Keychain. If you lose all your devices and forget the passphrase, your vault cannot be recovered – not even by us. That's the price of real end-to-end encryption.

Yes – 3 days, no credit card required. The trial starts automatically when you create your account in the app, with full functionality. When it ends, you won't be charged automatically: subscribe in the app to keep using Zack.

In the app, open Settings and choose “Delete Account”. This immediately deletes your account and all data on our servers and cancels an active Mac (Stripe) subscription. App Store subscriptions have to be cancelled in your Apple ID settings. You can also email us at hello@rapidrocket.com.

You don't lose your codes. They stay readable for 14 days, so nothing breaks in the middle of a login. After that, Zack only offers two things: subscribe again, or export all your keys to use them elsewhere. Export always works.