What Happens If You Forget Your Master Password?

Recovery is possible only when another authorized cryptographic path was created in advance—for example, a recovery code, an already-authorized device, a family recovery mechanism, or a trusted contact.

Signing in and decrypting are different problems

An email code may prove that you control an email account. It does not recreate a missing encryption key.

This distinction is easily missed because ordinary websites can reset a password after sending an email. Those sites generally use the password only to authenticate the user. A zero-knowledge password manager also uses secret material derived from the master password to unlock encrypted data.

A responsible recovery flow must solve both problems:

1. Verify that the requester is authorized.
2. Give that authorized user a legitimate way to decrypt the existing vault.

Completing only the first step can restore an account shell while leaving its vault unreadable.

What happens in Lockstep today

Lockstep derives an encryption key from the master password on the client. That key unwraps the random vault key used to encrypt vault records. The server stores only the wrapped vault key and encrypted data; it does not receive the unwrapped vault key or the client-side encryption key.

As reviewed on August 27, 2026, Lockstep's current implementation does not establish a provider-held master-password reset path that can decrypt an existing vault. Changing the master password is possible when the user can authenticate, unlock the vault with the current password, and rewrap the same vault key under a newly derived encryption key.

If the master password is truly lost and no authorized device or future recovery mechanism retains a usable key path, the existing vault cannot be decrypted by support.

That limitation should be stated plainly before users depend on the product.

Recovery methods and their tradeoffs

Recovery code

A high-entropy recovery code can protect a separately wrapped copy of the vault key. The user stores the code somewhere outside the vault.

This can be strong when:

• The code is randomly generated and sufficiently long.
• It is stored offline or in another strongly protected location.
• Recovery also verifies the account owner.
• Attempts are rate-limited and monitored.
• The user can revoke and replace the code.

It fails when the only copy is stored inside the inaccessible vault or when an attacker steals both the code and the required identity channel.

NIST recognizes saved recovery codes, issued recovery codes, recovery contacts, and repeated identity proofing as recovery classes in SP 800-63B. Not every class is sufficient by itself to recover encrypted vault data; the product must also design a cryptographic recovery path.

Authorized device

An existing unlocked or authorized device may be able to approve another device or export the vault. This reduces dependence on a memorized password, but it makes device security and revocation more important.

A phone that is unlocked, infected, or poorly protected can become the recovery vulnerability.

Family or organizational recovery

A family organizer or administrator may hold access to key material that allows an account to be re-established. This can be convenient, but it changes the trust model. Users must understand exactly what the organizer can recover and whether that authority extends to private vaults.

For example, 1Password documents recovery codes for individual and family accounts and organizer-assisted recovery for family members. Its recovery-code documentation says recovery requires access to the account email and results in new account credentials. Its family recovery plan separately warns that Emergency Kits are still needed if every capable organizer is locked out.

Emergency contact

A preauthorized contact may receive a wrapped key or gain a controlled ability to request access. A waiting period gives the owner time to reject a fraudulent request.

This can address both forgotten passwords and incapacity, but it creates additional questions:

• What if the contact's account is compromised?
• Can the owner revoke the contact?
• Is access view-only or full takeover?
• Does the contact bypass MFA?
• What happens if notifications fail?

See Password Manager Emergency Access: How It Works and What Can Go Wrong.

What not to do

Avoid recovery plans that quietly destroy the security model:

• Do not email yourself the master password.
• Do not save it in an unencrypted cloud note.
• Do not give it to several people “just in case.”
• Do not store the only recovery instructions inside the vault.
• Do not treat access to an email inbox as proof that someone should receive every vault secret.
• Do not assume a will automatically supplies technical access.

NIST's older password-manager FAQ advises users to be cautious of systems that simply recover the master password, while its current guidance recognizes controlled recovery methods. Those positions are compatible: recovery should restore authorized access through a designed mechanism, not reveal or reset a secret through an undocumented provider backdoor.

A practical preparation plan

Before you need recovery:

1. Choose a long, unique master passphrase that you can remember.
2. Enable the strongest available MFA for the password-manager account.
3. Store any recovery code outside the vault in a protected physical or digital location.
4. Keep at least one tested export or backup where the product supports it.
5. Document where recovery materials are located without copying secrets into the instructions.
6. Decide who should act during incapacity or death.
7. Review the plan annually and after family, device, or account changes.
8. Test the recovery procedure without destroying your working account.

The Digital Estate Checklist provides a broader inventory, while Password Manager vs. Digital Estate Plan explains why technical access and legal authority are separate.

The bottom line

A master-password reset is not automatically a feature. In a zero-knowledge system, it can be a new decryption path with serious consequences.

If you forget your Lockstep master password today and have no usable authorized key path, Lockstep cannot decrypt the existing vault for you. Prepare an external recovery plan before storing information you cannot afford to lose.