First-time setup

The first time you open SyncBins in a browser, you run a 7-step onboarding wizard. It registers this browser as a device, sets up your encryption keys, and drops you into your Inbox bin.

This page walks through every screen. If you already use SyncBins on another device and just need a pairing code, skip to Pairing more devices or choose path B below.

Before you start

You will need:

A modern browser (Chrome, Safari, Firefox, Edge)
Pen and paper (or a password manager) for the 12-word recovery phrase on a new vault
~2 minutes uninterrupted

There is no account password in the current onboarding flow — your vault is secured by the recovery phrase (and an optional local PIN).

If you are on the hosted product, signup happens before the wizard:

Choose your subdomain (e.g. gavin → gavin.syncbins.com).
Enter your email and submit Create my SyncBins →.
Open the URL you receive — the same 7-step wizard runs there.

Signup only creates your tenant. The recovery phrase, device keys, and encryption still happen inside onboarding on your subdomain.

The seven steps

Every path shares the same step counter (step N of 7 in the UI):

Step	Screen	All paths?
1	Welcome	Yes
2	How are you joining?	Yes
3	Recovery phrase	Create & restore only
4	Name this device	Yes
5	Device setup	Yes (bootstrap or pair code)
6	Quick-unlock PIN	Yes (skippable)
7	You’re in.	Yes

Step 1 — Welcome

Headline: A place to share things with yourself.

Tap Let’s go to continue. Footer shortcuts:

Pair with a six-word code — jumps straight to the pair path (path B).
Restore link — jumps to restore path (path C).

Step 2 — How are you joining?

Pick one of three cards:

Create a new SyncBin — first time on this server. You get a fresh 12-word recovery phrase. Use this on a brand-new hosted subdomain or a self-hosted server nobody has claimed yet.

Step 3 — Recovery phrase (create & restore only)

Create
Restore

Your twelve magic words.

Tap Tap to reveal to show the phrase.
Write it down offline — copy and print backup are available.
Tap I wrote them down to continue.

The phrase is the only way to recover your vault if every device is lost. The server never sees it.

Enter your recovery phrase.

Type all 12 words. The UI shows your vault fingerprint and probes the server (deviceCount, itemCount) so you can confirm you are on the right SyncBin.

If the server already has devices, you cannot bootstrap again — you will be sent to the pairing-code step instead.

Recovery scenarios Lost a device, forgot your PIN, or starting fresh — what to do in each case.

Step 4 — Name this device

Name this device — give this browser a label (e.g. “Work laptop”, “iPhone Safari”). Default is suggested from your browser/OS.

You will see this name on Settings → Devices and when generating pair codes.

Step 5 — Device setup

What happens here depends on your path:

Create / empty restore
Pair (path B or restore with existing devices)

Setting up your device… — automatic.

The browser derives your master key from the phrase, generates a Curve25519 keypair, and calls POST /api/devices/bootstrap. On success you are registered as the first device on this SyncBin.

If bootstrap fails with “already has devices”

Your server is not empty. Common fixes:

Interrupted first setup (self-host, no items yet): use Start setup again if offered — calls POST /api/devices/bootstrap/restart (single-tenant only, wipes orphan device rows).
Another device is already set up: choose path B and pair with a six-word code instead.
Restoring with phrase: enter the pair code from a device that still works.

Step 6 — Quick-unlock PIN (optional)

Set a PIN for this browser — 6+ digits that locally wrap your master key so you are not retyping 12 words every time the tab locks.

Tap Set PIN after entering and confirming digits, or Skip for now.
The recovery phrase always remains the source of truth.

Quick-unlock PIN What the PIN does, lockout rules, and threat model.

Step 7 — Done

You’re in. — your Inbox bin is ready. Tap Open my bins to reach the feed.

Tips on this screen: paste something, pair another device, explore Settings.

What got created

After onboarding, you have:

Thing	Where it lives
Device registration	Server: id, name, public key. Client: session token in localStorage.
Device secret key	IndexedDB, encrypted to your master key
Master key	Browser memory (cleared when tab closes)
Recovery phrase	Your offline backup only (create/restore paths)
Optional PIN wrap	localStorage on this browser only
Inbox bin	Local UI — default bin for new items

Each additional device you pair gets its own keypair. Items are encrypted so every paired device can decrypt them.

What the server never sees

Your 12-word recovery phrase
Your master key or PIN
Device secret keys
Item plaintext (only ciphertext blobs)

Return visits

Closing the tab clears the master key from memory. Next visit:

PIN set: unlock with PIN (or fall back to phrase).
No PIN: unlock with recovery phrase.

If you cleared site data or revoked this device, run onboarding again — usually path B (pair) or C (restore).

Troubleshooting

Problem	What to do
Cannot reach server	Check URL, DNS, and that Docker/compose is running (self-host).
Pair code expired	Generate a new code — codes last 5 minutes.
Recovery phrase does not match	Wrong phrase for this SyncBin, or typo — check vault fingerprint.
Setup didn’t finish	Go back to device setup; do not skip ahead to PIN/Done.
PIN lockout (5 wrong tries)	PIN is wiped — unlock with recovery phrase.

More scenarios: Recovery scenarios.

Next steps

Adding your first item Paste a link, drop a file, or type a note into Inbox.

Pairing more devices Phone, second laptop, or another browser — six-word code from Settings.

How encryption works Master key derivation, device keys, and what the server can see.