The Recovery Kit

At signup you are shown two codes, once. Together they are your Recovery Kit.

The Secret Key (SK1-…)

A second factor for key derivation, not for login. Your master password and this key are combined through Argon2id in its keyed mode to derive the key that unlocks everything else.

Its job is to make a weak password survivable. Without it, the strength of everything stored server-side would rest entirely on how good your password is. With it, server-side data is unbrute-forceable regardless — the attacker is missing 32 bytes of CSPRNG output that the server has never seen and cannot serve.

You need it when unlocking on a new device. On a device you’ve already used, your password alone is enough, because the key material is already there.

The Recovery Key (RK1-…)

Decrypts a backup of your account keys, so you can recover if you forget your master password.

That backup is stored server-side as ciphertext the server cannot read, and a copy also lives in your local vault file. Recovery with it does not change your key pair, which means all of your access — every environment grant — survives intact.

The format

Both are Crockford Base32 with a checksum, printed in groups:

SK1-XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-CCC

Crockford Base32 excludes the characters people confuse — no I, L, O, or U — and treats case as irrelevant. The trailing checksum means a mistyped character is caught locally, immediately, rather than after a 64 MiB key derivation returns “wrong password” and leaves you unsure which of the two things you got wrong.

Why you have to write them down

There is no reset

Lose your master password and your Recovery Kit, and your data is gone. Permanently. There is no support path, no override, no cooling-off period.

We cannot reset what we cannot read. The server holds ciphertext and public keys; nothing on it can decrypt anything of yours. That is the property that makes a breach of our infrastructure worthless to an attacker, and the same property makes account recovery impossible without a factor you hold.

Setup makes you acknowledge this before it will continue. That gate is deliberate friction, and it stays.

Storing them

Reasonable: a password manager, printed and filed somewhere physical, a sealed envelope in a safe. For a team, a copy held by someone else who isn’t you.

Not reasonable: the repository whose secrets it protects, a note on the desktop of the laptop it unlocks, or the chat thread you were trying to stop using for credentials.

After using the Recovery Key

A used recovery code is burned. Your client generates and uploads a fresh recovery backup automatically, so you always have exactly one live recovery path.

Write the new one down. It replaces the old one, and the old one no longer works.

If you lose the Kit but still know your password

You’re fine on this device — your password unlocks it. Two things to do promptly:

1. Change your master password, which re-establishes a fresh recovery backup and gives you a new Kit to write down.
2. Note that until you do, you cannot unlock on a new device: that path needs the Secret Key.

If you’re on a team

There is a second path. Admin-assisted recovery lets you mint a new key pair which grant-holding admins re-wrap access to, after verifying your new key’s fingerprint out of band.

It restores shared environments only. Anything you never shared with anyone still needs the personal Recovery Key. Say that number out loud before deciding the Kit doesn’t matter because you’re on a team.