PassSumo
FAQ
The questions that actually come up about PassSumo. If yours isn't here, the feedback form reaches the person who writes the code. Setting up an AI agent has its own step-by-step guide.
What does PassSumo need to run?
PassSumo requires macOS 27 or later.
Which database format does PassSumo use?
KDBX 4.x, the open format used by KeePass-compatible apps across desktop and mobile. PassSumo reads KDBX 4.0 and 4.1 and writes 4.1. Encryption is the format's own: AES-256 or ChaCha20 under a key derived with Argon2.
Can PassSumo open an older KDBX 3.x database?
It opens, but PassSumo never rewrites a 3.x file in place. To save changes you upgrade it: PassSumo writes KDBX 4.1 to a new file and continues there. Until then your edits are not written anywhere.
Why are new databases .psum, and can I open my .kdbx files?
New databases are created with the .psum extension; the file inside is KDBX. To open your existing .kdbx files, turn on “Open .kdbx databases” in Settings > Advanced. It is off by default, and PassSumo asks you to confirm when you turn it on: a database written by another app may contain data PassSumo does not preserve when it saves, so keep a backup of the original file. With it on, File > Open picks existing .kdbx files too.
Does PassSumo support key files?
No, and that is a deliberate choice. A key file is only a file on your disk. Any process that can read your files can copy it, whether that is malware, a compromised app, or an AI agent with file access. It adds a step for you, but not a real barrier for an attacker who is already on your machine.
A master password is stronger, but it is still something you type, and anything that watches your keyboard or screen can capture it. The only factor that holds up against software running on your own computer is biometrics backed by secure hardware: Touch ID and Face ID. That is where PassSumo puts its effort: Touch ID unlock on the Mac, and your own approval, with Touch ID or your Mac password, before an AI agent gets access.
If your database is protected by a key file, PassSumo will not open it. To use it with PassSumo, remove the key file in the app that created the database and keep a strong master password.
Does PassSumo have AutoFill or a browser extension?
No, by design. Filling a password into a running browser is attack surface this app deliberately does not have. You copy what you need, and the clipboard clears itself.
Does PassSumo store passkeys?
No. Passkeys need a system Credential Provider, and there is no settled cross-client convention for storing one in a KDBX file yet.
Can I store a crypto wallet recovery phrase or a payment card?
Yes. When you create an entry, choose Recovery Phrase or Card instead of the default login. A recovery phrase of 12 or 24 words appears in a numbered grid: paste the whole phrase and PassSumo splits it into words, and copy it back whole or one word at a time. Both are saved as ordinary named fields in your KDBX file, so other apps that read the format still show them.
How do I sync my database between devices?
PassSumo has no cloud and no sync service of its own. Between your own Macs, it can sync over Wi-Fi: pair the Macs once with a PIN, offer the database from one of them, and another Mac can open and edit it directly over your local network. The connection is encrypted and goes straight between the two Macs, with no server in between.
You can also simply keep the file in a folder. Your database is one file: put it in iCloud Drive, or any folder that already moves files between your devices, and every Mac that can reach that folder can open it. Keep it on local disk and it stays on the machine.
Does PassSumo collect any data?
No analytics, no telemetry, no trackers and no account. Your database stays on your Mac and the developer never sees it. The privacy policy has the detail.
I forgot my master password. Can it be recovered?
No. There is no way for PassSumo, or anyone else, to recover the master password or the database it protects. That is inherent to the KDBX format, not a limitation of this app.
Can an AI agent use my passwords?
Only if you choose. AI agent access is optional and off by default, and you turn it on separately for each database. You pick the folders an agent may see, and by default it can only read. With your approval on the Mac you can instead choose read and add entries: it can then create new entries in those folders, but never change, move or delete an existing one. Every grant is approved by a person, on the Mac with Touch ID or your Mac password, and it is time-limited and ends on its own. One menu command locks the database and revokes access. The agent connects through a local MCP server built into the app. The step-by-step guide shows how to set it up.
Does the agent actually receive my secrets?
Yes, and it is worth saying plainly. When you approve a request, the secret fields the agent asked for, such as a password, are returned to the agent. From that moment the value is in the agent's hands and PassSumo cannot take it back. The controls limit which entries an agent can ask for and for how long, not what it does with a value it has been given. Approve requests only for agents you trust, and allow only folders you are willing to hand over.