If your password manager could reset your master password by email, it could also read your vault. That is why zero-knowledge services can't simply send you a reset link. Recovery has to be planned in advance, with something only you have.
Option 1: a recovery key (the default)
When you set up a Potent Cipher vault, your device creates a random recovery key and shows it once. It can unlock a second copy of your master key, so with it you can choose a new passphrase and keep all your data.
- Print it or save it offline (a printed page in a drawer, a password-protected USB stick, a safe).
- Don't keep it only inside the vault it unlocks. That is like locking the spare key inside the house.
- If you think someone has seen it, make a new one in Settings. The old one stops working.
Option 2: a device that still opens
If the vault still opens somewhere without the passphrase (Windows Hello in the desktop app, or "Remember on this device" in a browser), your secrets are still within reach while you find your recovery key. A device that is already unlocked can also approve a new device, without typing the passphrase there. Setting a new passphrase, though, always needs the current one or the recovery key: an open session alone is never enough to change the key that protects everything.
Option 3: assisted recovery by email (optional, off by default)
Some people want a last resort in case they lose everything. Potent Cipher offers assisted recovery, off by default and clearly labelled as less private:
- With your vault unlocked, your device seals your recovery key to a key that lives on our server, separate from the database.
- If you ever request recovery, a link goes to your recovery email, followed by a 72-hour wait with alerts to your account email and devices. You can cancel at any time if it wasn't you.
- After the wait, the recovery key is released to your browser, which sets a new passphrase.
The trade-off is honest: with it on, a breach of both our database and our server could expose your vault. Use a different mailbox than your account email, so a single hacked inbox isn't enough.
If none of these are set up
Then the data is gone, by design. Nobody, including us, can decrypt it. It is a hard rule, and it is also the reason the vault is safe from everyone else.
Five-minute recovery checklist
- Print or save your recovery key and keep it somewhere other than the vault.
- Turn on Windows Hello or "Remember on this device" on a device only you use, as a second way in.
- Decide whether assisted recovery is right for you.
- Practise: lock the vault and open it again with your passphrase today.