For everyone still
using the same password.

01Ease is part of the point

A security habit has to fit into your life before it can help you.

That doesn’t mean everyone finds password managers difficult. It means some people do, and telling them the software is easy doesn’t remove the things getting in their way. Research with people trying a password manager for the first time has documented exactly these adoption hurdles.¹

Rosa starts with something you already know how to do: send a text.

There’s no app to install, no browser extension, no signup form, and no new Rosa username or master password. Text Rosa, ask to save a password part, and open the link in the reply.

You still need to choose your password parts and set the complete password on the website. Rosa makes remembering the different parts easier. It doesn’t change your website passwords for you.

02Give each website something different

When you reuse a password, one exposed login can become a way into other accounts. Attackers automate this: they take stolen email-and-password pairs and try them across other websites. They don’t have to break into your phone to try a password that’s already been stolen.²

Rosa helps you change that pattern with two parts:

Together, they make the password you enter on that website. If the website-specific parts are different, the complete passwords are different. A stolen password from one site won’t simply work unchanged on the others.

That is the practical improvement Rosa is designed to help you make.

The parts still need to be hard to guess. Adding a website’s name to a familiar password creates a predictable pattern. And the private part should be a new secret, not the old password you’ve already used everywhere.

03Yes, we know SMS has risks

SMS is not end-to-end encrypted. People can lose control of their phone number through SIM swapping, and someone with access to their phone or synced messages may be able to read their texts. Those are real risks.³

But a weakness doesn’t make a security measure worthless. CISA recommends MFA over none, while encouraging stronger, phishing-resistant options. SMS can add protection even though it has limits.⁴

Banks still use it too. Wells Fargo, for example, lists SMS as one way to receive an additional verification code for certain banking actions. That illustrates a familiar tradeoff; it doesn’t establish that Rosa has the same protection as a bank.⁵

With Rosa, knowing your phone number alone doesn’t let someone read your saved parts. They would need another way in, such as access to your texts, a working Rosa link, or a compromise of the service. That adds an obstacle beyond trying an already-stolen password on another website.

A bank may use a text as an extra check after a password. Rosa uses the text conversation to give you access to your saved parts, without a separate Rosa login. That’s a deliberate convenience tradeoff. Splitting your password doesn’t replace a website’s own two-factor authentication.

04The part you keep matters

When you follow the two-part approach, someone who gets Rosa’s stored part still doesn’t have your complete password.

That’s useful, but it isn’t a guarantee. A weak private part might be guessed. Someone who obtains both a complete password from a website and its matching Rosa part can work out the private part, which you also use elsewhere. Rosa also brings your saved parts together behind one phone number, so losing control of that number can expose more than one of them.

Keep your phone locked, protect your mobile-carrier account, and never forward Rosa’s links. Enter only the website-specific part on Rosa’s page; don’t text either part. Before giving up your number, retrieve what you need and arrange to delete your Rosa data. Use stronger sign-in options on websites that offer them, especially for your email and other important accounts.

Rosa doesn’t ask for your website usernames, name, or email to get started. That keeps the information you entrust to us smaller. It doesn’t make you anonymous: a phone number can often be connected to a person.

05Simple to use still means taking care of the data

Rosa’s save and view pages use encrypted HTTPS connections. Saved parts are encrypted in storage. Links use securely generated random codes, expire after ten minutes, and permit only the save or view you requested. The pages where you enter and retrieve parts load no advertising or analytics scripts.

These protections have specific jobs. They don’t make SMS encrypted, and Rosa’s systems can read the stored parts to return them to you. The private part you keep out of Rosa remains important. Our privacy policy explains the data handling in more detail.