Recovery Codes and Emergency Access: Planning for the Day You Cannot Log In
A password manager concentrates your credentials behind one secret, which is a good trade until the day that secret is unavailable. Most guides cover how to choose a strong master password and stop there. The harder question is what happens when a device is lost, a second factor breaks, or somebody else needs access. Recovery is not a feature you set once and forget; it is a small plan with a few documents in specific places.
Table of contents
- The lockout scenarios worth planning for
- What recovery codes actually are
- Emergency access is not the same as sharing
- What a manager cannot recover
- Building a plan that survives you
- The mistakes that defeat the plan
- FAQ
- Bottom line
The lockout scenarios worth planning for
Four situations account for most lockouts, and they call for different preparations. A lost or wiped device that held your only second-factor method. A forgotten master password after a long period of autofill. A changed phone number that breaks SMS-based recovery. And an incapacity or death where another person legitimately needs the vault.
The first three are recoverable with preparation and disruptive without it. The fourth is not really a technical problem at all: it is a question of who is authorised, how they prove it, and how long they should have to wait. Treating all four as the same “account recovery” setting is the most common planning mistake.
What recovery codes actually are
A recovery code or recovery key is a pre-generated secret that can restore access to an encrypted vault without the usual login path. It is not a password reset in the ordinary sense: the provider cannot read your vault, so the code is a second key rather than an identity check with customer support.
That distinction has two consequences. First, the code is as sensitive as the master password and should be stored somewhere that is not inside the vault it unlocks — a printed copy in a physically secure place, or a separate encrypted store with a different secret. Second, losing the code usually means losing the data. A provider that can simply reset you into the same vault would be one that can also be compelled or tricked into doing so for somebody else.
- Record where each copy of the code lives, and who could reach it.
- Replace the code after any use; most systems invalidate the old one on regeneration.
- Check whether the code restores the vault, or only the account login. These are not always the same thing.
Emergency access is not the same as sharing
Sharing gives another person access now. Emergency access gives a nominated person a way to request access later, normally with a waiting period during which you can refuse. That delay is the whole point: it converts a technical capability into a process with a human check.
Family or organisation plans handle this differently. Some allow a member with an administrator role to recover another member's vault; others rely on a nominated contact with a waiting period; some have no equivalent at all. The differences matter because they define who can act without you and how quickly. Read the specific mechanism rather than assuming that a family plan implies recovery.
It is also worth separating business continuity from estate access. A shared vault for household subscriptions solves the first. Access to accounts holding financial or legal records is the second, and it is usually better handled with a documented list of which accounts exist and where the instructions are, rather than with a blanket handover of everything.
What a manager cannot recover
Even with a recovery code, several things remain outside the vault's reach. Second-factor seeds that were never stored in the vault, accounts whose recovery email address no longer exists, and devices that require a separate unlock are common gaps. If a recovery flow sends a code to an address that is itself inside the locked vault, the loop is circular.
Make a short inventory of these dependencies: which email address each critical account recovers to, where its second factor lives, and whether that second factor is backed up. The point is not to enumerate every login but to find the two or three accounts that unlock everything else — typically the primary email, the mobile carrier account, and the password manager itself.
Building a plan that survives you
- Write one page of instructions: what the vault is, where the recovery code is, and who to contact. It should be understandable by somebody who is not technical and is having a difficult week.
- Give the instructions to a person, not only to a storage location. An encrypted file that nobody knows exists is not a plan.
- Choose a waiting period you can live with for emergency access: long enough to refuse an inappropriate request, short enough to be useful.
- Keep the primary email's recovery path independent of the vault, with its own second factor stored separately.
- Rehearse the non-destructive parts: sign in on a fresh device, confirm the vault syncs, and confirm you know where the recovery code is without opening the vault.
- Review once a year and after any change of phone, email, or nominated contact.
The mistakes that defeat the plan
Storing the recovery code as a vault item is the classic one. So is relying on a phone number as the only second factor, or naming a contact who does not know they have been named. A plan can also be too complete: a single document containing the master password, recovery code, and second-factor seeds is one exposed file away from total compromise.
There is a reasonable middle ground. Split the pieces so that no single store contains everything, keep the instructions legible, and prefer mechanisms with a delay and an audit trail over mechanisms that grant immediate silent access. The goal is that a legitimate person can get in eventually, and an opportunistic one cannot get in quietly.
FAQ
If I forget my master password, can support reset it?
With end-to-end encrypted vaults, support generally cannot restore the contents. Recovery codes, a recovery key, or an organisation-level recovery mechanism are the usual paths, and they must have been set up in advance. A provider offering an effortless reset should prompt a careful read of how the encryption is described.
Should I print the recovery code?
A printed copy in a physically controlled place is a reasonable option, because it is immune to a digital account lockout. The relevant risks are physical: who can access the location, and whether the paper will still be findable years later. Avoid keeping the only copy in the same device bag as the laptop.
Is a family plan enough for emergency access?
It depends on the product. Some plans allow an administrator to recover a member, some only allow shared collections, and some offer a nominated-contact flow with a waiting period. Check the specific mechanism and its delay before relying on it.
How often should the plan be revisited?
Annually, and immediately after changing your primary email, phone number, second-factor method, or nominated contact. Those are the changes that quietly invalidate a plan that still looks correct on paper.
Bottom line
A vault is a good trade precisely because it is hard to get into. That same property makes recovery planning worth an hour of your time before you need it, rather than after. Keep the recovery code outside the vault, make sure your primary email can be recovered independently, understand whether your plan offers delayed emergency access or only immediate sharing, and write one legible page of instructions for another human being. The objective is modest: no single lost device or forgotten secret should be able to lock out everything at once, and no single leaked document should be able to open everything at once.
If you want to compare current plans in this category, the link below goes to our own product page.