Forgetting a passphrase should not mean losing everything
For most online accounts, a forgotten password is an inconvenience. You request a reset link, prove your identity, and sign back in. The provider can restore access because it controls the account.
A vault protected by keys only you hold works differently. Your passphrase unlocks the key that decrypts your data. Without that key, the contents remain unreadable. A support team cannot simply reset your passphrase and make the encrypted data accessible.
Your recovery key gives you a second, independent way to unlock that data. It also carries a responsibility: anyone who obtains it may be able to use the same recovery route. If you lose both your passphrase and your recovery key, you lose the means to unlock your vault.
One secret to use every day. Another to keep safe.
A recovery key is a long, random secret created when your encrypted vault is set up. It is generated independently of your passphrase, rather than chosen by you or derived from personal information. Changing your passphrase does not change your recovery key. Either secret can unlock the data.
Unlike a passphrase, your recovery key is not meant to be memorised. Its randomness makes guessing impractical; secure storage protects it from being found or copied. Treat it with the same care as the secrets in your vault.
You may encounter related recovery mechanisms in disk encryption, encrypted backups and password managers. The names and requirements vary by product, so always check what a particular key can recover.
Two ways to unlock. The same encrypted data.
The data is encrypted with a data-encryption key. That key is stored in two encrypted forms: one protected by a key derived from your passphrase, the other by a key derived from your recovery key. Either route unlocks the same data-encryption key.
Changing your passphrase replaces the protection on the first copy. The recovery route remains available. Generating a new recovery key replaces the protection on the second copy, so the old recovery key no longer unlocks that updated copy.
A key-derivation function adds deliberate computational work to passphrase-based unlocking, making repeated guesses more expensive for someone who obtains the encrypted data. A recovery key also benefits from being generated randomly rather than chosen by a person. Its strength depends on that randomness; its safekeeping depends on you.
Your key restores access. Your backup preserves the data.
A recovery key unlocks encrypted data. It does not contain a copy of it. If your only copy is on a device that is lost or destroyed, there is nothing for the key to unlock.
You need both: a backup to protect against losing your data, and a recovery key to protect against losing access to it. Keep them separate.
For encryption where only you hold the unlocking secrets, support cannot retrieve your recovery key for you. Products that offer provider-assisted recovery use a different trust model. Understand who can restore access, what they need to do it, and what that means for your privacy.
Keep it offline. Keep it separate. Keep it findable.
- Print it or write it down. Store the recovery sheet somewhere secure, such as a safe or a locked location used for important documents.
- Separate it from your vault and device. Keeping both in the same bag or drawer can expose them to the same loss or theft. Do not store your only copy inside the vault it unlocks.
- Avoid photos and screenshots. They can sync to cloud accounts or create extra copies on your devices.
- Keep it out of email, messaging and ordinary notes apps. Every extra digital copy creates another place where the key could be exposed.
- Consider a second secure location. A safe-deposit box or a sealed envelope stored securely at another address can protect against losing the first copy.
- Plan for an emergency. If appropriate, tell a trusted person where to find it. Choose carefully: access to the key may enable access to your data.
Lost it or exposed it? Replace it.
Generate a new recovery key if your recovery sheet is missing, if someone may have copied it, or if a person you shared it with should no longer have access.
Secure the new sheet, confirm the replacement key, and update any second copy. Then destroy the old sheets. Follow the product's instructions for keeping backups recoverable after the change.
A missing key puts your recovery plan at risk. A copied key can put your privacy at risk too.
Be ready before you need recovery
- You know where your recovery key is stored.
- Your copy is readable and kept offline in a secure location.
- It is separate from your vault, device and backup.
- You have a separate backup of the encrypted data.
- You have confirmed that the recovery key works.
- If you have an emergency-access plan, the person you trust knows where to find the key.