Recovery key: what to do if you forget your master password
With zero-knowledge encryption, nobody but you has the key to your vault - not even us. That's why you get a recovery key when you sign up. Here's how it works and where to keep it.
Blog · Security
Zero-knowledge in practice: how Inlockly encrypts your data
"Zero-knowledge" is an easy promise to make. Here's exactly what happens to your data - from typing your password to syncing with a second device.
Contents
What “zero-knowledge” means
In a zero-knowledge model, the service provider doesn’t know your data or the keys to it. Encryption and decryption happen only on your devices, and the server stores and syncs nothing but encrypted content. In practice, that comes down to three layers.
1. Your master password stays with you
When you type your master password, the Argon2id algorithm derives a key from it. Argon2id deliberately uses a lot of memory and computing power - a single sign-in takes a fraction of a second, but guessing passwords at scale becomes very expensive. Your master password itself is never sent to the server.
2. Every item is encrypted with AES-256-GCM
Your data is encrypted with a random vault key using AES-256-GCM. The vault key is protected separately, with the key derived from your master password - so changing your password doesn’t require re-encrypting your whole vault. GCM also detects whether anyone has tampered with the encrypted data, and a fresh random nonce for every encryption means the same item looks different every time.
3. Shared vaults and RSA-OAEP
How do you share an encrypted vault with your family or team without revealing the key to the server? Every member has a key pair. The shared vault key reaches each member encrypted with their public key (RSA-OAEP) - only they can decrypt it. The data itself is still encrypted with AES.
What the server sees
| Data | What the server sees |
|---|---|
| Master password | Nothing |
| Passwords, notes, and cards | Encrypted content only |
| Vault key | Encrypted only |
| Email address, plan, device list | Yes - needed to run your account |
The connection to the server is also protected by TLS, and we store data in the European Union.
What this means for you
- A server breach won’t expose your passwords - an attacker would get encrypted noise.
- We can’t reset your master password - that’s why you have a recovery key.
- A good master password and 2FA are your part of the deal.
Get the details in our Security Whitepaper. Architecture, key management, authentication, and sharing - documented in our technical documentation.
The Inlockly team
We write about password and data security the same way we build our app: practical, no scare tactics, no jargon.