Most security failures happen on ordinary days, not movie-hacker days. Forgetting a master password is one of those ordinary risks. If your vault is private by design, recovery has real limits. The important thing is to understand those limits before you need help.
What Zen Passwords can and cannot do
Recovery boundaries in plain language
| Question | Answer |
|---|---|
| Can support decrypt my vault? | No. There is no vendor-side backdoor unlock path. |
| Is a forgotten master password the end of the vault? | Not if you prepared. A recovery key you saved, or social recovery, can get you back in. |
| What is social recovery? | Your recovery key split across people you trust. No single one of them can open your vault; together they can help you back in. |
| Can biometrics replace master password forever? | No. Biometrics are convenience unlock, not ownership replacement. |
| Can backups help if device is lost? | Yes, if you prepared and stored encrypted backups safely. |
| Can old manager exports save you during migration? | Yes. Keep them until your new vault is fully verified. |
Security explained simply
Zen Passwords uses modern vault encryption and key-derivation patterns (AES-GCM style sealing and Argon2id stretching in current architecture and copy). In simple terms, your master password is not just a login string. It is part of how your vault keys are derived. Lose it, and no support shortcut should exist to bypass that.
Your 10-minute recovery checklist
- Save your recovery key somewhere safe, or turn on social recovery. Do this on the day you create the vault, not the day you need it
- Write and test a master password strategy you can remember under stress
- Enable biometric convenience unlock, but keep periodic master-password refresh enabled
- Set lock-on-leave and a practical idle lock timer
- Run one encrypted backup export and confirm where it is stored
- Review top accounts and confirm their independent recovery methods
Security confidence comes from rehearsed habits, not hope. Start now on the Zen Passwords page, and set policies before an emergency forces rushed decisions.
What actually happens when you type your master password
It helps to know why the limit exists, because "we cannot reset it" sounds like a policy and it is not. It is arithmetic.
- Your master password goes into a key derivation function, Argon2id, along with a random salt stored with your vault.
- Argon2id is deliberately slow and deliberately memory hungry. That is the point: it makes guessing expensive for an attacker with a fast machine, not just for you.
- What comes out is a key. Not a password check, a key.
- That key decrypts your vault. If the key is wrong, what you get back is noise, and there is no partial credit.
There is no stored copy of the password to compare against, and we hold no second key. The vault is not guarded by a lock that someone can pick. It is unreadable until the right key is derived. That is why the recovery options below matter: they are ways for you to keep a copy of that key, or to split it among people you trust, rather than ways for us to get in.
Why a back door would not stay yours
Any mechanism that lets support unlock your vault has to exist before you need it. That means a second key, held by the vendor, that opens your data. Once that key exists it is a target: for an attacker who compromises the vendor, for an employee who should not have used it, and for anyone who can compel the vendor legally.
The version of this trade you want is the one where the answer to "can you open this for me" is genuinely no, because then the answer to everyone else is also no. Convenience in the rare case you forget, or safety in every other case. It cannot be both.
The three habits that make recovery unnecessary
Make the password long rather than clever
Four or five unrelated words you can picture beat a short string of symbols on both counts: they are harder to guess and far easier to remember under stress. The failure mode you are designing against is your own memory on a bad day, not a cryptographer.
Type it on purpose, not just Face ID
Biometric unlock is convenience, and convenience quietly erodes memory. If the only time you have typed the master password is the day you set it, you do not know it. Turning on a periodic master password prompt keeps the muscle alive at a cost of a few seconds a week.
Keep one encrypted export you have actually opened
An untested backup is a belief, not a backup. Export once, confirm the file opens, and store it somewhere that survives losing the phone. The point is not the file. The point is knowing the file works before the day you need it.
If it has already happened
Work through this in order, because the early steps are the ones people skip and they are the ones that usually work.
- Do not delete or reinstall the app. A reinstall can remove the local vault before you have exhausted the alternatives.
- If the app is still unlocked anywhere, on another device or a session you have not closed, stop and export from there first.
- Try the passwords you nearly used. People rarely forget completely. They usually forget which variant they chose.
- Check where your last export went, if you made one, and whether you still know the password for it.
- If none of that works, treat it as a rebuild: reset the important accounts through their own recovery paths, starting with your email, because email is the account that recovers all the others.
It is a bad afternoon rather than a catastrophe, and it is survivable in a way that a vendor with a copy of everybody’s keys is not.
