Emergency Kit and Secret Key

Your Crunu account is protected by two secrets. You choose the password. The Secret Key is created on your device when you create your account. Your account key is derived from both, on your device, and neither one is ever sent to the server. The Emergency Kit is a printable sheet with your Secret Key, so you can sign in on a new device.

The Secret Key

A Secret Key looks like this: K1- followed by six groups of letters and digits separated by hyphens. The first group is a non-secret tag that tells you which account the key belongs to. The rest is about 128.8 bits of randomness.

Why it exists: if someone stole a full copy of the server's database, they couldn't guess your password, because each guess would also need your Secret Key, which never reaches the server. A strong password still matters, but the Secret Key makes offline guessing useless.

Where it's kept:

• on each device where you signed in, in the browser's storage, or in a file with mode 0600 for crunu when you use --remember-secret-key;
• in your Emergency Kit.

When you type or paste a Secret Key, letter case, spaces and hyphens don't matter.

The Emergency Kit

You get the Emergency Kit right after creating your account. It contains:

• the server address;
• your email and account ID;
• the organization;
• your Secret Key;
• a blank line to write your password by hand, if you choose to;
• the date;
• a QR code with a setup string for signing in on a new device. The QR code doesn't contain your password.
• How to sign in on a new device.

Use Print or save as PDF, or Copy Secret Key. You can't continue until you tick I've printed the Emergency Kit or saved it somewhere safe. While the kit is on screen, the vault doesn't lock itself for inactivity, so the sheet isn't lost. Don't leave the page unattended.

Store the kit away from your devices, and away from your recovery code. To see and print it again later, sign in on a device where you're already signed in and open Account, then Security.

Signing in on a new device

A new device needs your email, password and Secret Key. You can paste the setup string from the QR code instead of typing the Secret Key. If you turned on Two-step verification, it also needs a second factor:

• a code from your authenticator app;
• a passkey;
• or approval from a device where you're already signed in. Both screens show a 6-digit code to compare.

Remember email and Secret Key on this device saves them, so next time you only enter the password on that device.

Changing your password or Secret Key

You can change either when you know the current password. Your data isn't re-encrypted. Only the wrapper around your keys changes, so your certificates and machines' trust in you stay the same. A stolen session can't do this: the change needs a signature made from your current password and Secret Key, entered again.

If you lose them

The server can't reset a password. It knows neither half of your key. What you can do depends on what you still have:

Device compromised

Device compromised… creates new account keys, a new password and a new Secret Key, signs out every other device and rotates every environment where you had a key. Your old recovery codes stop working, so create a new one afterwards.

What the Emergency Kit can't do

The kit alone doesn't open your account. It still needs the password, and usually a second factor. A recovery code, on the other hand, does open the account after a waiting period. Keep the two apart.