Recovery code

A recovery code is your way back in if you forget your password or lose your Secret Key. It's separate from the Emergency Kit: the kit helps you sign in on a new device, while the recovery code lets you set a new password and a new Secret Key.

How it works

The code looks like R1- followed by 52 characters in groups of four. It's created on your device. The server stores only an encrypted copy of your account's key material that the code can open, and a public key to check the code. The server can't do anything with that copy without the code. The code is useless without the server, because the encrypted copy isn't on the sheet.

Creating one

Open Account, then Security, then Recovery code, and choose Create recovery code. You need your current password, because only an open account can make the encrypted copy. A stolen session alone can't create a code.

Print it and store it separately from your devices and from your Emergency Kit. You can have at most two active codes. Delete a code from the same page if anyone may have seen it, and create a new one.

Using it

1. On the sign-in page, choose Forgot your password or lost your Secret Key.
2. Enter your email and the recovery code.
3. Wait. The server doesn't release the keys at once. It waits, one hour by default. During that time you get an alert that recovery has started, and so do the admins of your organizations.
4. After the wait, set a new password. You get a new Secret Key and a new Emergency Kit to print.

What happens to your account:

• It's the same account. Your keys and your access to every environment stay as they were.
• Every previous session and every other device is signed out. Sign in there again with the new password and Secret Key.
• The code you used stops working. Create a new one right away.

If it wasn't you

If you get a recovery alert and didn't start it, cancel the attempt from your account, or sign in: a successful sign-in during the wait, or in the hour before it started, stops the recovery. A canceled code can't start a new attempt for a day. Then delete that code and create a new one.

The waiting period is enforced by the server. A compromised server working with a thief who has your code could release the keys at once. Without the code, the server can do nothing.

When the code stops working

• after you use it;
• after you delete it;
• after Device compromised…, which replaces your account keys. Create a new code afterwards.

Changing your password doesn't affect recovery codes.

If there's no code

Without a password, a Secret Key and a recovery code, nobody can open the account, not the server operator and not an owner of your organization. What an organization can do is give you access again with a new account:

1. An owner or admin removes the old account from the organization. The member removal wizard rotates the environments where the old account had a key.
2. They invite you again, to another address if the old one is still taken.
3. You accept, create a new account, print its Emergency Kit and compare your key fingerprint with the admin.
4. They confirm you and grant your environments.

If recovery of personal environments is on in the organization, which is the default, an owner or admin can also move the old account's personal keys to your new account with Employee recovery….

Plan ahead

• Every organization should have at least two owners, or an owner and an admin. If every owner and admin loses access and nobody has a recovery code, nobody can manage the organization any more. Members with their own keys can still read their environments.
• Everyone should have a recovery code and a printed Emergency Kit, stored away from their devices.
• Everyone should have a second factor.

On a self-hosted server, the waiting period is set with RECOVERY_DELAY.