Authentication & Access
I forgot my Master Password. Can I reset it?
No. WebStray Authenticator is a zero-knowledge application. There is no password reset mechanism. If you lose your password and do not have an active session, your data is permanently lost. You must reset the database and restore from a JSON export (using your Export Password for the file’s protected record payloads).
See Import & Export for details.
Data & Backups
Import says "Invalid JSON File"
This error occurs if the file structure does not match the expected WebStray Authenticator format or if the file was tampered with manually. Always use fresh, unmodified .json files generated by the Export function.
Import fails with a "Wrong Password" error
The password required for import is the Export Password created at the time of the backup, not your current Master Password. If this password is lost, the protected value fields in the JSON file cannot be recovered.
Why do some entries show as "Corrupted"?
A corrupted status indicates a decryption failure for a specific record. This can happen if the record was encrypted with a different key or if the local database file was corrupted on disk. To fix this, delete the record or restore from a healthy backup.
Database & Persistence
Where is my data stored?
Your data is stored in a vault.db file within the application's data folder. To locate that folder on disk, open Settings, open Plugins, then click the "plugins" link in the dialog to reveal the plugins directory on your machine. The database file typically lives one level up, in the main application data directory.
When should I use "Compact Database"?
Use this option if you notice performance degradation or if the database file size seems unusually large. Compacting removes internal fragmentation and optimizes storage without affecting your records.
Sync & Display
My TOTP codes are not working
The most common reason is a time mismatch between your computer and the service provider. Ensure your system clock is synchronized with an internet time server (NTP). Even a 30-second offset can make codes invalid.
The "Copy" action doesn't seem to work
For security, some secrets (Passwords and Tokens) must be shown via the Actions Menu before they can be clicked to copy. Open the menu, select Show, and then click the plaintext value to copy it.
System
Why did my "Auto-Unlock" stop working?
Since the session is bound to your Machine ID, significant changes to your OS user profile or hardware components can invalidate the session token. Sign In manually using your Master Password. This will generate a new hardware-bound session token for your current environment.
Plugins
My plugins do not appear in the list
Ensure the following conditions are met:
- Directory: The plugin folder must be placed directly inside the application's plugins directory.
- Structure: Each plugin folder must contain both a valid
package.jsonand anindex.jsentry point. - CLI: If installed via CLI, ensure the command finished without errors and restart the application.
Plugin Development
I modified my plugin code, but the UI didn't update
While the application includes a filesystem watcher, some deep logic changes may require a manual reload. Try disabling and re-enabling the plugin in Settings or restarting the application.
My plugin crashed the app
Plugin UI components are wrapped in Error Boundaries. If a plugin fails, a warning will appear in the side panel, but the core app will remain stable. For debugging, ensure you are using the SDK flavor of NW.js to access Developer Tools.
Summary
Most issues in WebStray Authenticator can be resolved by restoring data from a JSON export backup. Always keep your Master Password and Export Passwords in a secure, offline location.