On this page
An Emergency Kit is a document, printed or saved as a PDF, that holds what you need to sign in to an encrypted account on a new device, above all a Secret Key that the service itself does not keep.
Why it exists
In a vault where encryption happens on your devices, the vendor cannot open your data, and so it cannot reset your password either. That protects you if the vendor's servers are breached. It also means a lost device plus a forgotten password can lock you out for good. The Emergency Kit is the paper copy that keeps that from happening.
1Password uses the same name for a similar document. Its support page describes a PDF with the sign-in address, email, Secret Key and a space to write the account password.
What Crunu's Emergency Kit contains
When you create a Crunu account, the app shows your Emergency Kit before you continue. You print it or save it as a PDF and confirm "I’ve printed the Emergency Kit or saved it somewhere safe." The kit holds:
- your Secret Key, the random half of your account key, written as
K1-followed by groups of 6, 6, 5, 5, 5 and 5 characters; - a QR code for setting up a new device.
The QR code doesn't contain your password. Your password never goes to the server and can't be recovered, so remember it or keep it in a password manager.
Where to keep it
- On paper, somewhere physically safe, away from the laptop it protects.
- As a PDF, in storage that does not depend on the devices you could lose.
- Not only inside the Crunu account it protects, since you need the kit precisely when you can't get in.
If you lose it
You can still sign in on any device where Crunu already knows your Secret Key. Beyond that, Crunu has two recovery paths:
- Recovery code. A personal code,
R1-…, that you create in advance. Using it releases your keys after a waiting period, one hour by default, while you are notified; signing in as yourself cancels the attempt. The wait is enforced by the server, so a compromised server could skip it. - Employee recovery. If the organization setting is on (it is by default), an admin can move the personal environments of a lost account to the employee's new account.
Without your password, Secret Key and recovery code, nobody can open the account, including Crunu. If every owner and admin of an organization loses access, nobody will be able to manage it. See Emergency Kit and Secret Key, recovery code and create an account.
Sources
- 1Password Support: Get to know your Emergency Kit, checked October 27, 2026.
From the blog
Security
Why a vault vendor can’t reset your password
With a password and a Secret Key, nobody at the vendor can open your account, or reset it. How the Emergency Kit works, and what to do when something is lost.
Self-hosting
Self-hosting a secrets vault: choosing a platform
Docker on a VPS, Cloudflare Workers, Vercel or Cloud Run? What changes between platforms for a blind-server vault, and the two decisions you make only once.
Security
What “the server can’t read it” actually means
A blind server is a precise claim with precise limits. What Crunu's server stores, what it cannot do even if compromised, and what it still sees.