Help & FAQ
Quick answers. Still stuck? Write to us.
Can you see my 2FA codes?
No. Your accounts are encrypted on your device with a key only your master password can unlock. We store ciphertext we cannot decrypt.
What if I forget my master password?
We cannot reset it or recover your vault. Keep your recovery kit somewhere safe, make encrypted backups, and keep the backup codes each website gives you when you turn on 2FA.
Do codes work offline?
Yes. Codes are generated on your device from the current time. Once your vault is unlocked, no connection is needed. Sync needs a connection.
How do I move from Google Authenticator?
In Google Authenticator choose "Transfer accounts → Export", then open Settings → Import in Bloom and scan the QR (or upload a screenshot on web). Unencrypted 2FAS and Aegis exports work too.
How do I move to another app later?
Use Transfer to show Google-compatible QR codes, or create an encrypted backup. You are never locked in.
Why do I need both a sign-in and a master password?
Signing in (Google or a passkey) proves who you are so we can sync your vault. The master password is what decrypts it, and it never leaves your device.
Is biometric unlock safe?
It's optional. When on, a copy of your vault key is kept in your phone's secure hardware and released only after Face ID or fingerprint. Anyone who can pass your phone's biometrics could open the vault, so only enable it on a phone only you use.
A code is rejected. What now?
Check your device's clock is set automatically; TOTP codes depend on the exact time. Wait for the next code and try again.
How do I delete my account?
Settings → Delete account. Turn off 2FA on websites first (or move those accounts elsewhere), because deleting removes your encrypted vault permanently.
Does Bloom use cookies or trackers?
No trackers, no ads, no analytics. The web app only stores what it needs to keep you signed in and your preferences. See the Cookie notice.
Contact support
Found a security issue? See responsible disclosure.