Your encryption passphrase

This is the most important page in this guide. Please read it before choosing your passphrase.

Why Swish asks for one

Your financial information is genuinely private in Swish — not "private" in the sense of a promise, but
in the sense that it is technically impossible for Swish to read it.

Here is how that works:

1. You choose a passphrase. It stays on your device and is never sent to Swish.
2. Your browser turns that passphrase into an encryption key.
3. Everything sensitive — balances, transactions, register entries, notes, documents — is scrambled with
   that key before it leaves your device.
4. Swish's servers store only the scrambled version. Without your passphrase, it is meaningless.

The trade-off is the one you would expect: because nobody at Swish holds your key, nobody at Swish can
recover it for you.

Setting your passphrase

The first time you sign in, Swish shows the Set Up Your Encryption Key screen.

1. Enter your Passphrase.
2. Enter it again in Confirm Passphrase.
3. Use the eye icon beside each field to check what you have typed.
4. Select Confirm & Continue.

Cancel backs out without setting anything up — but you will be asked again, because Swish cannot
store your data until a key exists.

Setup takes a few seconds while your browser generates your keys. Do not close the tab while it is
working.

Choosing a good passphrase

A passphrase is not a password. Longer and more memorable beats short and cryptic.

Do:

• Use three or more unrelated words, with 15–128 characters in total.
• Spaces between words are allowed. Capital letters, numbers, and symbols are optional.
• Do not add spaces at the beginning or end of the passphrase.
• Pick something you will recall in six months without a hint.
• Write it down and store it somewhere genuinely safe: a password manager, or a sealed note somewhere
  secure at home.

Do not:

• Reuse your Swish sign-in password, or any password you use elsewhere.
• Use anything guessable from your public life — birthdays, names of family or pets, your address.
• Rely on remembering it. Six months is a long time.

Store it somewhere safe before you continue. Once you have data in Swish, losing your passphrase
means losing that data permanently.

Entering it each session

Every time you sign in, after your email and password, Swish shows Enter Your Encryption Key.

Type your passphrase and select Continue.

This happens every session by design. Swish does not keep your key anywhere that survives closing
your browser. That is what protects you if you use Swish on a shared or public computer — someone opening
the browser after you cannot reach your data.

You will not be asked again while you stay signed in, including if you refresh the page.

A new tab or window will ask again. Your key is held per browser tab, so opening Swish in a second
tab means entering your passphrase there too.

If you forget your passphrase

There is no reset, no recovery link, and no support process that can restore your data. This is not a
policy Swish could change — the key does not exist anywhere Swish can reach.

If you have lost your passphrase, contact support. They can help you start again with a fresh
encryption setup, but anything you had already saved will not be readable. You would need to
reconnect your banks and re-enter your records.

Which is why: write it down, and keep it somewhere safe.

Changing your passphrase

Encryption settings live under My Profile → Encryption. See
Your profile and settings.

You can change a passphrase that you still know:

1. Open My Profile → Encryption.
2. Enter your current passphrase.
3. Enter and confirm a new passphrase that meets the guidance above.
4. Select Change passphrase.

Swish checks your current passphrase on your device and protects your existing encryption key with the
new passphrase. Your encrypted data does not need to be replaced, and the current session stays unlocked.
Use the new passphrase the next time Swish asks you to unlock your account.

This is a change, not recovery. If you have forgotten the current passphrase, Swish cannot decrypt the
key in order to protect it with a new one.

Things you might see

"Encryption keys are loaded"

Everything is working. Your data is unlocked for this session.

"Unlock your data before opening or downloading files." / "Unlock your data before uploading files."

You are trying to open, download or upload a document before your passphrase has been entered. Refresh
the page and enter your passphrase when prompted.

Being sent back to the passphrase screen

If you open a Swish page directly (from a bookmark, say) before entering your passphrase, Swish sends you
to the passphrase screen first, then on to where you were going. That is the security check doing its job.

"Encryption setup incomplete… Please contact support"

Something interrupted your original setup — a closed tab or a lost connection at the wrong moment. Swish
deliberately stops rather than guessing, because guessing could make your existing data unreadable.
Contact support and they will sort it out.

Quick answers

Does Swish know my passphrase? No. It never leaves your device in any form.

Can support look at my accounts to help me? They can see that your account exists and whether
technical operations succeeded. They cannot see your balances, transactions, or documents.

Is it safe to write it down? Safer than forgetting it. A password manager is ideal; a sealed note in a
secure place at home is fine.

Can I use the same passphrase as my password? Please don't. They protect different things and are
handled by different systems.

What if someone gets my passphrase? They would also need your Swish sign-in to use it. If you think
either has been exposed, change your sign-in password and encryption passphrase immediately.