NewsCompaniesFlawsGuides
Get the app
EverywhereHARD codes

HARD codes

How to pair HARD codes with family in person, what to do when someone calls asking for money, and where the codes are kept on your devices.

Updated View as Markdown

A voice can be cloned and a number can be faked. A HARD code can’t be guessed. Two people pair once, in person, and then each sees the same six-digit code for the other, changing every 30 seconds (the same standard authenticator apps use, RFC 6238).

Pair with someone

  1. Be in the same room.
  2. One of you shows a code: Show mine on iPhone, or Pair with someone in HARD for Mac.
  3. The other taps Scan someone’s code on their iPhone and scans it.
  4. Each of you names the other, and you’re paired.
HARD codes on iPhone: Mum and Sarah with their codes, Scan someone’s code and Show mine
HARD codes on iPhone
HARD codes on Mac: Mum, Dad and Sarah, each with a code and Check a code
HARD codes on the Mac

When someone calls asking for money

  1. Ask for their HARD code.
  2. Tap their name and type what they read out. On iPhone, HARD asks for Face ID, Touch ID or your passcode before it shows codes.
  3. Match: it’s them. Doesn’t match, or they can’t open the app: hang up and call them back on the number you already have.
Checking Mum’s code: It’s really Mum, the code matches
The code they read out matches: it’s really them.

Where codes are kept

Codes are kept only on the two devices, in the Keychain: never synced to a server, never in backups. HARD never sends a code anywhere. To remove a pair on iPhone, press and hold their name.

Coming Pairing with family overseas, end-to-end encrypted, with four safety words you compare on a video call.

Questions

How do HARD codes work?

You and a family member pair once, in person: one of you shows a QR code, the other scans it. After that, both apps show the same six-digit code for each other, changing every 30 seconds. When someone who sounds like them calls from a new number asking for money, ask for their HARD code. Match: it’s them. No match, or “I can’t open the app right now”: hang up and call them back on the number you already have.

Where are the codes kept?

Only on the two devices, in the Keychain. They’re never synced to a server or put in backups, and HARD never sends a code anywhere. Codes are read aloud.

Can we pair over the phone or by message?

No, on purpose. A pairing link sent remotely is refused, so someone who isn’t in the room can’t join in. Pairing family overseas is planned.

Still stuck? Write to support, and tell us what you’ve tried.