How do I change my vault passphrase?
Security · Help center · Current as of 2026-10-10
Short answer
In Settings, under Security, give the current passphrase and a new one of at least 12 characters. Nothing is re-encrypted: the vault has its own random key, and changing the passphrase only re-wraps that key, so the operation is instant however many codes you have. With sync on, the new wrapped key is uploaded so your other devices accept the new passphrase.
Why it is instant
Your codes are encrypted under a random key that belongs to the vault, and your passphrase encrypts that key. Rotating the passphrase replaces the wrapper and leaves every encrypted object exactly as it was. The practical consequence is that there is no reason to put off changing it, and no window during which half your vault is in one state.
What your other devices do
They learn the new passphrase from the uploaded wrapped key the next time they sync, and the old passphrase stops working on them at that point. A device that is already unlocked carries on until it locks. If the upload fails — no connection, a session that needs signing in again — KeyNesta says so explicitly, and those devices keep the old passphrase until you change it again while online. Do not assume it propagated; check that sync ran.
What a change does not touch
- Backup files. Each keeps the backup password it was sealed with. An old backup is not reachable with a new passphrase.
- The sync account password. A different secret for a different job, changed in a different place.
- Other vaults on the device. Each has its own passphrase and its own key.
"Current passphrase is wrong" means exactly that and nothing was changed. If you cannot produce the current one, there is no override — see what can be recovered.
Try KeyNesta free. The web app needs no sign-up.
Open the web app All platforms