What happens if you forget the password

2026-09-10

Your files are gone. Permanently. Nobody can help you — not us, not a support desk, not a court order. That is not a gap in the product. It is the product.

The uncomfortable trade

Every app that can reset your password can also open your data without you. Those are the same capability described two different ways. A "Forgot password?" link means the service holds a key, and anything the service holds can be handed over, stolen, subpoenaed, or sold in an acquisition.

So a vault has to choose. Either it can rescue you when you forget, or it can promise that only you can open it. Not both. Anyone offering both is not doing what you think they are doing.

What "gone" actually means here

When you make a vault, a random key is generated and used to encrypt your files. That key is then locked with your password. Your password is never stored — not hashed, not encrypted, not anywhere. What sits on disk is a locked box containing the key.

Forgetting the password does not lock you out of a system that could let you back in. It means the box stays locked, and the bytes on disk stay random, for as long as the mathematics holds. Guessing is deliberately expensive: every attempt has to run a key derivation that takes about a second, so a million guesses take about eleven days of the phone doing nothing else.

The one safety net, and its cost

Because "gone forever" is a harsh way to lose family photos, each vault also produces 12 recovery words when you create it. They are shown once, never stored, and they unlock the same key your password does.

That is a second door, and it is worth being clear-eyed about it: anyone holding those 12 words can open the vault without the password. They deserve the same care as the password itself — better, because they cannot be changed.

Write them on paper. Paper cannot be synced, searched, or backed up to somebody else's computer. A screenshot works too and the app allows it, but the picture lands in your gallery, and most galleries upload themselves to a cloud account. Whoever can open that account can open the vault.

What to do in the first five minutes

1. Choose a password you will still know in a year. A long phrase you can picture beats a short scramble you cannot.
2. Write the 12 words on paper, and put the paper somewhere you would keep a passport.
3. Lock the vault and open it again immediately, before you put anything important in. Find out now whether you remember it.
4. Remember the original file is still in your gallery until you delete it. A vault does not empty your camera roll for you.

The rule underneath all of this: a vault is not a backup. It is the opposite of a backup. Anything you cannot afford to lose should also exist somewhere else you control.