Skip to content
Create free account
Create free account
Security7 min read

Why a vault vendor can’t reset your password

With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.

Crunu teamPublished 7 min read

Example. Kiteline is a fictional company.
On this page

Most online services have a "forgot password" link that sends you an email and lets you choose a new one. A secrets vault built so that its server cannot read your data cannot offer that. If the vendor could reset your password and then open your account, the vendor could open your account, and so could anyone who took over the vendor's systems.

This post explains the trade-off behind that, how Crunu derives your account key from two secrets, what the Emergency Kit is for, and what your options are when something is lost. The short version: keep the Emergency Kit somewhere safe, create a recovery code, and none of this will ever be a problem.

The trade-off

There are two ways to design account access for a service that stores sensitive data.

The service can recover your account. Your data is encrypted with keys the service can reach. When you forget your password, it verifies you some other way, by email or support ticket, and gives you access again. Convenient, and it means the service can read your data whenever it needs to, or whenever someone forces it to.

Only you can open your account. Your data is encrypted with a key derived from secrets only you hold. The service stores ciphertext and has nothing it could use to decrypt it. If you lose your secrets, the service cannot help, because helping would require exactly the capability the design removes.

Crunu takes the second path. Its server cannot reset your password, and that is a property of the product, not a missing feature. The rest of the design is about making sure you do not lose access by accident.

Two secrets, not one

Your Crunu account key is derived on your device from two inputs:

  1. Your password. Something you know. It is stretched with PBKDF2-SHA256 at 1,000,000 iterations, which makes every guess deliberately slow.
  2. Your Secret Key. A random value of about 128 bits, generated in your browser when you create the account. It is written as K1- followed by groups of 6, 6, 5, 5, 5 and 5 characters: a short tag that identifies the account, then 26 random characters.

Neither is sent to the server in any form. The server stores the encrypted account keys and a public key used to check your sign-in signature, and nothing that would let it recompute the account key.

Why the second secret

Slow key derivation is good practice, but on its own it only slows an attacker down. The OWASP Password Storage Cheat Sheet recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256, and RFC 8018, which defines PBKDF2, describes the iteration count as a way to raise the cost of each guess. A short or reused password can still fall to someone with a copy of the database and enough time.

The Secret Key changes that. Because it is random and never stored on the server, a stolen database is useless for offline guessing: the attacker would have to guess about 128 random bits in addition to your password. The protection no longer depends on how good your password is.

1Password uses the same two-secret idea. Its documentation describes the Secret Key as working together with the account password and notes that 1Password keeps no copy and cannot recover it (1Password Support). Crunu's sign-in follows that model.

The Emergency Kit

The catch with a random Secret Key is that nobody can memorize it. You type it once per device, and your devices remember it. So it needs a safe home for the day you get a new laptop, or lose one.

That home is the Emergency Kit: a sheet you print or save as a PDF when you create your account. It contains:

  • your Secret Key;
  • a QR code for setting up a new device.

The QR code does not contain your password, and neither does the kit. Before you can continue, the app asks you to confirm "I’ve printed the Emergency Kit or saved it somewhere safe."

Where to keep it:

  • On paper, somewhere physically safe, away from the laptop it protects.
  • As a PDF in storage you can reach without that laptop, such as an encrypted drive or a password manager you also use elsewhere.
  • Not only inside Crunu. You need the kit precisely when you cannot get in.

You can print it again at any time from a device where you are signed in, under your account's security settings.

Signing in on a new device

On a new device you enter your email, password and Secret Key, from the Emergency Kit or by scanning its QR code. If you have two-step verification on, which you should, you also confirm with a code from an authenticator app or a passkey. Instead of a code, you can approve the new device from one where you are already signed in, by comparing a six-digit code shown on both.

On a device you trust, you can tick Remember email and Secret Key on this device, so you only type the password next time. The command line tool has the same option, crunu login --remember-secret-key.

When something is lost

Here is what to do in each case, from least to most serious.

You lost the Emergency Kit but can still sign in somewhere

If any device still remembers your Secret Key and you know your password, sign in there and print a new Emergency Kit. Nothing else changes.

You forgot your password or lost every copy of the Secret Key

This is what the recovery code is for. It is a personal code, starting with R1-, that you create in advance from your account's security settings. To use it, choose Forgot your password or lost your Secret Key on the sign-in page and enter your email and the code.

Keys are not released immediately. There is a waiting period, one hour by default, during which you and the admins of your organizations get an alert. If it is not you, signing in to the account cancels the attempt. After the wait, you set a new password, get a new Secret Key and print a new Emergency Kit. Your account, its keys and your access to environments stay the same; other devices and sessions are signed out.

Two honest caveats. The recovery code opens the account after the wait without a second factor, so store it as carefully as the kit. And the wait is enforced by the server, so a compromised server could release the keys at once. A recovery code is a convenience you choose to have, with that trade-off.

You have neither the password, the Secret Key nor a recovery code

The old account cannot be opened by anyone, including Crunu. Your organization can still restore your work access:

  1. An owner or admin removes the old account from the organization, which rotates the keys of environments it held.
  2. They invite you again, you create a new account, print the new Emergency Kit straight away, and verify your key fingerprint with them.
  3. They grant your environments and access profiles to the new account.

If the organization keeps the default setting for personal environments, an admin can also move the personal environments of the lost account to your new one, through the organization's recovery key. If that setting was turned off, those personal environments were sealed only to the old account's keys and are gone.

Your device was stolen, but you know your secrets

This is a different case: you have not lost anything, but someone else may have a device that remembers your Secret Key. From another device, choose Device compromised… in your security settings. Crunu creates new account keys, a new password and Secret Key, signs out every other device and rotates the keys of every environment where you had a key. Old recovery codes stop working, so create a new one.

A stolen device that is still signed in is limited in the meantime. Keys are forgotten after the idle timeout, 10 minutes by default. And a signed-in session cannot change your password, your Secret Key or delete your account, because those actions need a signature made from the current password and Secret Key, entered again.

A setup checklist

Do these on the day you create your account:

That is the whole cost of a vault that nobody else can open. A few minutes of setup replaces a "forgot password" link that would otherwise be a back door.

More in Emergency Kit and Secret Key, recovery code, create an account and the glossary entries for Secret Key and Emergency Kit.

Sources

Terms in this post