Information and data stored by a mobile device is protected by comprising applying password-protection to the locally-stored information without persistently storing the corresponding password locally. Rather, the corresponding password is stored by a remote password server. In response to a trigger event on the mobile device, such as an unlocking action by the user, a request is sent by the mobile device to the password server to retrieve the corresponding server, and the corresponding password is returned to the mobile device. The mobile device can then use the password to access the protected information. If the user determines that the mobile device is lost, stolen, or out of the user's physical control, the user may access the password server and disable the sending of the password to the mobile device, thereby thwarting attempts to access the protected data on the mobile device.