Can KeyNesta recover my vault if I forget the passphrase?
Security · Help center · Current as of 2026-10-10
Short answer
No, and not through support, not with proof of identity, not by any route. Your passphrase never reaches us, so there is no key anywhere outside your device that could open the vault. This is the cost of the same design that stops anyone else reading your codes.
Why no exception is possible
The vault is encrypted with a key derived from your passphrase. The server holds ciphertext and no key. A support team with the power to let you back in would, by definition, also be able to read everyone's vault — and would be a target worth attacking. The absence of that power is the feature.
What still works if you have forgotten it
- A device that is still unlocked. If any device still has the vault open, export from it immediately and set up a new vault with a passphrase you record properly.
- The services themselves. Each account's recovery or backup codes, and its account-recovery process, are controlled by the service and not by KeyNesta. That route is unaffected.
If every device is locked and you have no backup codes, the entries are gone and each account has to be recovered through its provider. Lost phone recovery covers that process.
Avoiding it
Record the passphrase somewhere durable before you rely on the vault — a password manager, or paper somewhere safe. And keep an encrypted backup: it does not help with a forgotten passphrase, but it covers every other way of losing access.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms