Recovery & Emergency Kit

Because PulsVault is zero-knowledge, the same design that keeps our servers from ever reading your secrets also means we can't reset your master password or decrypt your vaults for you. This page covers the other half of that trade: the instruments that get you back in, all of which have to exist before you need them.

Account → Recovery & Emergency Kit holds three of them on one screen — your recovery email, your identification code, and the entry point to Access Key recovery. Hardening lives on its neighbours: Two-factor authentication and Master password.

The credentials that protect your account#

Everything below revolves around four things you received when you created your account. Keep them straight:

Credential	What it does	Where you manage it
Master password	Signs you in (gate 1) and helps derive your encryption keys (gate 2)	Account → Master Password
Access Key (PULS-…)	Combines with your password to unlock your vaults	Recover it under Account → Recovery & Emergency Kit
Recovery Key (REC-…)	Last-resort key that lets you recover a lost Access Key or password	Your Emergency Kit only — never stored raw
Identification code	Confirms it's really you during recovery and support	Account → Recovery & Emergency Kit

The server keeps only hashes and wrapped forms of these — never the raw values. Together with your master password, the Access Key and Recovery Key make up your Emergency Kit.

Your recovery email#

A second address we can reach you at if you lose access to your primary one. Enter it, choose Save, and that is the whole of it.

It is worth being precise about what it does not do: a recovery email is a contact channel, not a key. It cannot decrypt anything, it cannot reset your master password on its own, and someone who compromises that mailbox does not thereby gain your vault. Do not confuse it with your Recovery Key (REC-…), which is the thing that actually opens the vault and lives only in your Emergency Kit.

Your identification code#

The identification code uniquely identifies your account during Access Key recovery and when you contact support. It is issued once, when your account is created, and it never changes — there is no way to regenerate or replace it. Store a copy alongside your Emergency Kit.

• It is hidden by default. Select View code and confirm your master password to see it.
• Once it is shown, use the copy control to put it on your clipboard. It is cleared from the clipboard after the delay set in your Vault settings, like any other secret you copy.
• Hide code forgets it in the page; viewing it again asks for your master password again.
• Never share it outside official support channels — it's an identity signal, not a password.

Every view is a master-password check: it is recorded in your activity log, and repeated wrong passwords block further attempts from that network.

Recover a lost Access Key#

If you still know your master password but have lost your Access Key (so your vaults won't unlock), you can mint a new one from Account → Recovery & Emergency Kit → Start recovery. Recovery is a layered challenge — you'll need three things from your Emergency Kit and 2FA setup:

1. Identification code — enter your secret identification code.
2. Second factor — enter a code from your authenticator app, or the requested numbered backup code.
3. Recovery Key — enter your REC-… key from your Emergency Kit.
4. Save your new Access Key. Your browser generates a fresh PULS-… key and shows it once — store it in your Emergency Kit right away, because you'll need it to unlock your vaults going forward.

This works precisely because the Recovery Key holds a second wrapped copy of your master key. Your browser proves you hold the Recovery Key by sending a one-way verifier of it — never the key itself — then generates the new Access Key, re-seals your master key under it, and sends the re-sealed copy with a verifier of the new key. Your keys and your master key are only ever handled on your device — the server never sees them, before, during or after recovery.

If it says "recovery is not finished"#

Sometimes the key is issued and the re-seal fails. The page says so plainly rather than showing you a success screen — because until the re-seal lands, the key on your screen does not open your vault.

1. Save the key first. It is shown once whether or not the second half succeeded, and losing it costs you the account.
2. Choose Retry applying the key. This re-runs only the re-seal, with the same key. It never generates another one — that would replace the key you have just saved.
3. Do not sign out. If retrying keeps failing, contact support while still signed in.

Until the retry succeeds your account is still on its previous Access Key, so nothing is broken — the old key keeps working. That is why this is a retry and not a disaster.

Account recovery when you've lost your password#

Recovery deliberately requires your Access Key and Recovery Key plus an emailed one-time code — not an email link on its own. Neither key is sent: your browser derives a one-way verifier from each and sends those, so the keys never leave your device. That's not an inconvenience we could remove: with zero-knowledge encryption, the server has no way to re-encrypt your secrets for a brand-new password it helped choose, so an email-only "forgot password" reset would hand you an account it could never actually decrypt.

Quick reference: what to do if you lose…#

You've lost…	You can recover if you have…	Result
Your authenticator app	A backup code	Sign in, then re-enroll 2FA
Your Access Key	Identification code + 2FA + Recovery Key	Your browser generates a new Access Key
Your master password	Access Key + Recovery Key + emailed code	Set a new password; data preserved
Both Access Key and Recovery Key	—	Account is unrecoverable

Related#

• Two-factor authentication — TOTP setup and backup codes
• Master password — rotate the password you sign in with
• Create your account & Emergency Kit — how you got these credentials
• Zero-knowledge model — why recovery works the way it does
• Devices — manage which devices unlock faster