What happens if I forget my master password?

In a zero-knowledge manager the vendor can't reset it, so you need whatever fallback you set up: a recovery phrase, an Emergency Kit, a hint or an emergency contact. With none of those, the vault can't be opened.

What is a password manager recovery phrase?

A recovery phrase is a list of ordinary words, such as 12 words from the BIP-39 list, that encodes a random secret you can write down and use as a fallback key if you lose your master password.

Can Secure It reset my master password?

No. Secure It Password Manager has no company servers holding your data or key, so we can't reset it for you. Recovery uses your 12-word phrase and Emergency Kit.

Where should I store my recovery phrase?

On paper or a printed Emergency Kit, in a locked place away from your devices. Avoid screenshots, cloud notes, email and any file stored beside the vault.

What is an Emergency Kit?

In Secure It, the Emergency Kit is a PDF that includes your recovery phrase and an offline recovery script. Print it or store it safely offline, and treat it as sensitive as the master password.

Is a recovery phrase the same as a master password?

No. The master password is something you choose and type to unlock the vault. The phrase is randomly generated and kept as a backup, but anyone who holds it should be treated as having a key.

Forgot Your Master Password? Recovery Phrase Explained

Short answer

In a zero-knowledge password manager, the company cannot reset a forgotten master password, because it never holds the key that opens your vault. Recovery therefore depends on something you keep yourself. Secure It Password Manager gives you a 12-word BIP-39 recovery phrase and an Emergency Kit PDF that includes the phrase and an offline recovery script.

Secure It is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours. I'm the developer, so read the Secure It sections with that in mind. The rest of this page applies to any zero-knowledge manager.

Why zero-knowledge makes recovery your job

Your master password is not stored anywhere for a vendor to look up. It is run through a key-derivation function (Secure It uses Argon2id) to produce the key that encrypts and decrypts your vault, and that happens on your device. We use AES-256-GCM for the encryption itself.

That design is the whole point: nobody who breaks into a server or a cloud account can read your passwords. The price is that a support team has nothing to reset. Bitwarden says this plainly: its employees and systems have no way to retrieve or reset your master password. KeePass's help says the same: there is no backdoor and no universal key that can open your database.

So the useful question is not "who can reset it?" but "what did I set aside before I needed it?"

What a recovery phrase is

A recovery phrase is a short list of ordinary words that encodes a randomly generated secret, so you can write it on paper and type it back in later. The BIP-39 standard defines the format. A 12-word phrase comes from a 2,048-word list, where each word carries 11 bits. Together that is 128 bits of randomness plus a 4-bit checksum that catches most typing mistakes.

Because those 128 bits are random, they are not guessable the way a human-chosen password can be. That is why a phrase can act as a fallback key.

What a phrase is not:

It is not a hint. Anyone who holds it can potentially do whatever the app lets a phrase do, so treat it like the master password itself.
It is not stored by a company that can restore it for you. If you lose it, there is no "send me my phrase again".
Its exact powers depend on the app. A phrase in one product may restore the vault, in another it may only help you set a new password. Check what your manager says.

How Secure It handles recovery

What we can state precisely:

Secure It gives you a 12-word BIP-39 recovery phrase.
It also offers an Emergency Kit PDF that contains the recovery phrase and an offline recovery script.
Your vault is encrypted on your device. A vault works fully offline on one device with no Google sign-in. If you choose to sync, a single encrypted file (vault.enc) sits in your own Google Drive.
We run no servers for user data, so we cannot see your vault or your phrase, and we cannot reset anything on your behalf.

What this page does not cover: the step-by-step recovery screens in the app, and whether recovering lets you choose a new master password or only open the existing vault. We haven't published those steps yet and won't guess at them here. Follow the app's own instructions, and if you are stuck, write to talhaaslamdev@gmail.com. For the overall design, see Security and Secure It at a glance.

One more honest limit: Secure It has no independent third-party security audit yet.

Where to keep your phrase

Make the phrase and the Emergency Kit survive the same things that would make you forget your password: a lost phone, a dead laptop, a stolen bag.

Do: write the words on paper, or print the Emergency Kit, and keep it somewhere locked and separate from your devices, such as a home safe. A second copy in another trusted place is reasonable.
Do: check that you copied every word, in order, and spell them as the word list does.
Don't: take a screenshot, which syncs to photo backups.
Don't: save it in a cloud note, an email draft or a file next to your vault. If an attacker reaches that place, the phrase gives them a way around your master password.
Don't: store it only inside the password manager. If you can't open the manager, you can't read it.

Also set a master password you can actually remember. NIST's current guidance (SP 800-63B-4) says a password used as a single factor should be at least 15 characters, with no forced character-type rules. A long passphrase of unrelated words is easier to remember than a short, complicated one. See is it safe to keep passwords in Google Drive for how the master password protects a synced vault.

How recovery works in other managers

Checked against each vendor's own documentation on 18 Oct 2026. Details change, so confirm with the vendor.

Manager	Can the vendor reset your master password?	What you can use instead
Bitwarden	No	Password hint by email, emergency access contact (Premium), organization admin recovery if enabled, logging in with a trusted device or passkey; otherwise delete the account and start over
1Password	No	Password saved in your Emergency Kit, an optional recovery code you create in advance, or family/team admin recovery
KeePass	No (no vendor involved)	Nothing: no backdoor; every key component must be remembered or kept
Secure It	No	12-word recovery phrase and Emergency Kit PDF with offline recovery script

Each model has trade-offs. Bitwarden and 1Password offer more recovery routes, which helps families and organizations, but each route needs setup before you get locked out. KeePass is the strictest and the simplest. Secure It sits closer to the "something you keep" model: the phrase is yours, and no account at our end can override it.

What if you lose both

If you forget the master password and also lose the recovery phrase and Emergency Kit, the vault cannot be opened. That is not a bug or a policy choice. Without the key, the encrypted file is unreadable to us, to Google and to anyone else.

Before giving up, try these:

Look for any device where the app is still unlocked, and export from there.
Check for old printouts of your Emergency Kit.
Try variations of the master password you might have used, on a device where you can test them.
If you can't recover, create a new vault and reset your most important accounts first (email, banking, cloud storage) using each site's own "forgot password" flow.

Prevention checklist

Create your recovery phrase when you set up the vault, not later.
Print or write it down, then store it away from your devices.
Test that you can find it. Don't wait for an emergency.
Choose a long master password you can remember without writing it in the vault.

Forgot your master password? How a recovery phrase works