This seems ominous:

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

500+ passwords, lot of changing.  This will require a triage.

 re-enrolling two-factor authentication methods? just for msecure, or every account referenced within msecure?

all passkeys that I use? 

all passkeys that I use on devices  that has msecure installed?  

just the passkey to access msecure?

If I perform these recommendations, and use the current version of msecure to manage these changes, what risks are the security implications?

H i, just for info and not a recommendation.

I've been doing some digging into online local Wi-Fi sync, and the only two names that keep coming up are Strongbox and Enpass. Both are relatively small companies, but they appear to offer functionality broadly similar to mSecure.

My main concern is that they are both quite niche products and don't appear to have the same level of independent security auditing as the larger organisations.

I've had a quick play with the free version of Strongbox, and it looks OK. However, you need to start a Pro trial to test the Wi-Fi sync feature, which I haven't done yet. I haven't tried Enpass at all, so I can't comment on that from personal experience.

One thing worth noting is that Strongbox uses a .kdbx database format, like KeePass.

The good thing is hat you can keep everything local, within your own home network, without relying on cloud services. However, the lack of any major independent security audits for Strongbox does give me some pause for thought.

Anybody had used StrongBox? 

Original founder: Mark McGuill.

Original company: Phoebe Code Limited (UK).

New owner (2025):  Applause (Applause Group), a US-based group of independent app developers.

Current arrangement: Applause took over Strongbox in March 2025. Mark stepped back but offered to remain available in an advisory capacity.

@Eltoro

Just checking out Enpass this morning, so far looks good, as I've got WiFi sync working between my Mac and & iPhone, exported a few Software Licences from mSecure and they were all imported correctly to the correct category.

Enpass has been the only one I've found so far that actually lists mSecure as an import option, so this is looking promising.

Most practical (for Apple’s mobile ecosystem) is Keepassium, based on Keepass. Both open source, both completely offline. Vaults are 1:1 exchangeable. Keepassium is based in Luxembourgh and falls under and complies to strict EU-laws regarding privacy and security. Keepass itself is supposed to be able to import the messy csv’s that msecure generated (not tried yet). Furthermore, Keepassium had a security audit not that long ago and passed with flying colors.

@Vinicius

unfortunately my reply seems to be blocked :-/

 @Vinicius
unluckily, this is the real issue: we just don't know how deep the issue is, I also sent several follow up questions to understand if I can safely restart using mSecure (I used a DropBox sync) but having no answer I just cannot trust it anymore. I've reset all my most important passwords (about 100) and added dual factor authentication to every account that didn't have it already, but I'm not storing the new passwords in mSecure until I know it's safe. Every other tool I tested is unluckily worse (in terms of flexibility and features) but I guess that security comes first.

The radio silence is deafening. It’s the one and only mistake that brought their company out of business. Mseven seems to have no idea what to do now. Probably only legal discussions going on there. With one main question: how do WE get out of this unharmed and unliable? We meager users need to know as little as possible to not trigger us. We don’t know what happened with vaults, if they were always phoned home to msecure during any kind of sync or not etc. PLEASE INFORM YOU PAYING CUSTOMERS WHO ARE PROBABLY IN VERY DEEP S***. Or much less. But nothing is clear. Very sad

@Ron

I actually think they know exactly what to do. My guess is that they're working through the following timeline:

1. Get the lawyers in to formulate the "admit nothing" communication that is currently being fed to customers who submit tickets.
2. Create a new company.
3. Transfer assets to new company, including all rights to the source code.
4. Let mSeven fail and fall into insolvency. There's nothing left to take action against.
5. Three months' time, launch a new - at least, new UI'd version with cloud syncing removed - version of the product. Give it a catchy name. Advertise how capable it is of loading mSecure backups (because, basically, it is mSecure). Put out some nonsense in the advertising about how many extra cycles of PBKDF2 the new software uses, or that it is super resilient to attack because it uses Argon2, and why didn't everyone. Even put out on their new website a comparison to mSecure, with articles entitled something like 'No cloud! Keep control of your data.' and 'Why we're better than mSecure: no HNDL here!')
6. Charge all the customers. Again.
7. (Some time later) Write a book with a catchy title, something like "How to be a Phoenix CEO" or "You too can crash and burn and still make a million". In the book explain how you really, REALLY felt the customers' pain, so much so that you had to go on a three-month retreat to The Post Ranch Inn to meditate, looking over the Pacific whilst listening to ancient folk chants and eating berries hand-picked on a moonless night. 

I suspect that we're somewhere between steps 3 and 4 at the moment. 

Although it might be worth checking the reservations at The Post Ranch Inn.

Hi

The Pro Version of Strongbox gives you wi-fi sync. If I were to choose StrongBox I would personally use local storage and just either backup to external SSD on home network or if yr comfortable copy the encrypted backup to Apple iCloud storage .

@Bill @Corrado,

StrongBox supports importing an mSecure CSV file, and the process works, although some tidying up is required afterwards. Unfortunately, the initial CSV export from mSecure isn't particularly good – it's quite messy and, of course, doesn't include any attachments. StrongBox also seems to be geared towards Apple devices.

So far, I've only installed the free version of StrongBox on my iMac as a test. I haven't installed it on iOS yet, but it seems fairly intuitive and syncs using Apple's Bonjour service.I still need to investigate Enpass and KeePassium in a bit more detail. The disappointing thing is that there are so few password managers on the market offering local Wi-Fi syncing.

It's a shame that some of the better-known providers don't offer this option, as local Wi-Fi sync would be a really useful feature.

@Corrado 

I haven't picked anything yet. I only recently came across Strongbox and Enpass, so I've started looking into them.

The main consideration for me isn't so much the subscription cost, but rather how secure  these products are and external audit give a tad more confidence and help in the decision making process..

They are all relatively niche companies, much like mSecure, so I'd want to be confident in their long-term security, reputation and reliability before committing. I will have a look into KeePassium but all my digging has so far led me to StrongBox & EnPass for the Wi-Fi Local sync reason thats not to say KeePassium is not good or better as I don't know

That said, if I decided to go with Strongbox, I'd be perfectly happy to pay £79.99 for a lifetime licence rather than have an ongoing subscription.