Recovery phrases explained

Some apps, when you set them up, show you a short list of ordinary words and ask you to keep it. That list is a recovery phrase. It can feel like a chore. It is actually the app being honest with you.

Why it exists

Most apps let you reset a forgotten password by email. That works because the company holds an account and a way back to your data. An app with no account, where the company never sees your data, has no such door. If you forget your code, the recovery phrase is the only spare key. Nobody else has a copy, including the people who made the app.

Words are used because they are easier to write down and read back correctly than a long string of random characters, and a handful of randomly chosen words is very hard to guess.

How to store it

Do:

• Write it on paper, by hand, in the order shown.
• Check the spelling of each word before you put the paper away.
• Keep it somewhere private and stable: a locked drawer, a document folder, a safe.
• Consider a second copy in a different place you trust, such as with important papers at a relative's home, if that is safe for you.
• Tell no one what it is for, and do not label it.

Don't:

• Save it in a note, screenshot or photo on the same phone. If someone opens the phone, they find both.
• Email it to yourself or put it in a cloud document.
• Keep it in your wallet or phone case, which travel with the phone.
• Choose a custom phrase from a song, quote or anything someone could look up.

In VaultWell

VaultWell, coming soon, gives each vault a recovery phrase of six or more words. You can let the app generate one or write your own. To confirm you have it, you type back three of the words. There is deliberately no copy or download button, to keep the phrase off the phone.

If you forget a path and lose the phrase, the vault cannot be opened by anyone, including us. You can try making a phrase with the phrase generator.

Related

• Zero-knowledge and end-to-end encryption explained
• How to move a vault to a new phone