Unlocking, Device Factor and Recovery

This guide teaches you how to open your vault quickly and safely every day, and how to make sure you are never permanently locked out. By the end you will be able to unlock with a device gesture instead of retyping your master password, change your master password with confidence, and know every route back in if you ever forget it.

Unlocking and What Re-Locks the Vault

After this section you will understand the lock model. You open the vault by entering your master password, which decrypts it locally on your device. A wrong password fails on your own device, never on the server, so there is nowhere for an attacker to sit and guess. The vault re-locks when you would want it to: after an idle period, when you explicitly lock it, when you sign out, when you switch to another organization, and if the session is revoked. Locking is local: a locked vault holds no readable key in memory.

Unlock Faster with a Device Factor

After this section you will reopen the vault with a fingerprint, face, or PIN instead of your full master password. After your first master-password unlock on a device, you can enroll a device factor, also called instant unlock. It uses your device's built-in platform authenticator, the same kind behind Touch ID, Windows Hello, and hardware security keys, so that later unlocks on that device take a quick verifying gesture rather than the full master password. You enroll a device through the Backbuild desktop app today; the iOS and Android apps will offer the same when they ship.

It is important to understand what this is and is not. It is re-authentication with a cheaper gesture, not the removal of authentication. Your master password stays the primary way to bootstrap a device, a fresh verifying gesture is required every single time you unlock, and nothing that could silently open the vault is stored at rest. On the Backbuild desktop app, your operating system's secure hardware store is the custodian of the device key. If a device has no compatible authenticator, you simply keep using your master password, which stays fast.

The device second-factor card in Backbuild settings, shown here in the web app. Callout 1 marks the card, titled This device as a second factor. Its text explains that you open Backbuild in the desktop or mobile app to register this device with its built-in security chip, so it can automatically satisfy the extra security check when you unlock your vault here.
The device second-factor card in Security settings. On the web it points you to the Backbuild desktop app, where you register the device so it satisfies the vault step-up automatically (the iOS and Android apps will do the same once they ship). The master password remains the bootstrap and the fallback.

Change Your Master Password

After this section you will be able to rotate your master password without disrupting your team. You can change your master password at any time. Because your vaults are protected by keys that are wrapped to your public keys rather than to the password itself, changing the password does not force you to re-share any vault or re-key your team. Your access and everyone else's continues uninterrupted.

Changing your master password (or explicitly revoking your Emergency Kit) issues a fresh recovery secret and cryptographically retires the old one, so a kit you printed before the change can no longer be used. If you rotate your password, save the new Emergency Kit and destroy the old printout.

If You Forget Your Master Password

After this section you will know that forgetting is recoverable, and how. Backbuild cannot reset your master password, because it never holds it and cannot read the vault it protects. That is the guarantee that keeps everyone else out too. Recovery therefore comes from something you set up in advance, not from a support ticket. There are two routes.

The Emergency Kit (self-service)

When you first set up the vault, Backbuild generates a strong, machine-made recovery secret and shows it to you once: your Emergency Kit. Store it somewhere safe and offline, such as a printout in a locked drawer or a record in a separate, trusted place. If you ever forget your master password, the Emergency Kit lets you recover your account and set a new one. Keep it as carefully as you would a spare key to your home, because it is exactly that.

Administrator-assisted recovery (in an organization)

An organization can enable administrator-assisted recovery so a member who loses their master password is not stranded. It works without weakening zero-knowledge: a member opts in ahead of time, while their vault is unlocked, so that a designated recovery administrator can later help them reset. When recovery happens, the administrator restores the member's access and the member sets a new master password, and at no point does the administrator, or anyone at Backbuild, see any secret value in the member's vault. It restores access, it does not expose contents.

This is the answer to the recovery paradox. A vault you can recover by emailing support is a vault the provider can read; a vault no one can ever recover strands people who forget a password. Administrator-assisted recovery threads the needle: recovery is possible, but only through material the member entrusted in advance to an administrator of their own organization, and the recovery restores access without ever revealing a secret. It is not a back door, because there is no path by which the provider can open a vault.

A diagram of the ways to get into the vault, arranged as a ladder. Everyday: master password, and device factor as a faster gesture on a trusted device. If the master password is forgotten: the Emergency Kit saved at setup, or administrator-assisted recovery in an organization. A side note reads: no Backbuild employee can reset your password or read your vault; recovery restores access, never reveals a secret.
Everyday access is your master password or a device gesture. If you forget it, the Emergency Kit or administrator-assisted recovery restores access, never a secret value. Backbuild can do neither.

What happens if I forget my master password? Am I locked out forever?
No, if you prepared. Use the Emergency Kit you saved when you set up the vault, or, in an organization that enabled it, administrator-assisted recovery. Both restore your access and let you set a new master password. What is impossible is a provider-side reset, because that would mean the provider could read your vault.

Is the recovery path a back door that weakens zero-knowledge?
No. Self-service recovery relies on a secret only you hold. Administrator recovery relies on material the member entrusted in advance to an administrator of their own organization, and it restores access without anyone, administrator or Backbuild, ever seeing a secret value. There is no path by which the provider can open a vault.

If I change my master password, do I have to re-share all my vaults?
No. Vault keys are wrapped to your keys, not to your password, so changing the password leaves all your sharing intact. Do save the new Emergency Kit that the change issues, and destroy the old one.

Is instant unlock less secure than my master password?
It is re-authentication with a cheaper gesture, not the absence of it. A fresh verifying gesture is required every unlock, the master password remains the bootstrap and fallback, and nothing that could silently open the vault is stored at rest.

Next Steps