Forgot Your Master Password? What Happens and How to Recover

If you forgot your master password, the company behind your password manager usually can't reset it, because it never knew it. Your way back in is a spare key you set up earlier: a recovery kit, a device that's still signed in, or, on some services, email recovery. Without one of these, the vault generally can't be opened by anyone.

Forgot your master password? What to do first

Locked out right now? Work through these steps in order.

1. Leave any signed-in device alone. If your vault still opens on a phone or computer, don't sign out, restart it, let the battery die, or delete the app. Some apps ask for the master password again after a restart.
2. Try to remember, slowly. Check Caps Lock and try on the device where you usually type it. Go easy on guesses, since some services pause sign-in after several wrong tries.
3. Look for your recovery kit. Check printouts, file boxes, and USB drives, and search your computer's Downloads folder for "recovery kit" or "emergency kit."
4. Check your manager's official help pages. Type its web address yourself to see which recovery options it offers. On a family or work plan, ask the organizer or IT admin too, since some plans let them help.
5. Watch out for recovery scams. A real support team won't ask for your master password or recovery kit, so treat anyone who does as a scammer.

Why the company usually can't reset it

With most online accounts, "forgot password" works because the company can confirm it's you, usually by email, and let you choose a new password. Password manager account recovery works differently, on purpose.

A good password manager uses encryption, which scrambles data so only the right key can unscramble it. Your vault (the private space where your logins live) is encrypted on your own device with a key made from your master password, and the company's servers store only the scrambled version.

That protects you if the company is ever breached. It also means the company can't open your vault or swap in a new master password, because if it could, so could a thief who broke into its systems. Here's more on what happens if a password manager gets hacked.

The same lock that keeps strangers out will keep you out if you lose every key. That's why master password recovery has to be set up before you need it.

Recovery options that actually work

Services differ, but the recovery options that genuinely work fall into three groups.

A recovery kit or spare key

A password manager recovery kit, sometimes called an emergency kit or recovery key, is a file or printable sheet you save when you sign up.

Some kits can reset a forgotten master password on their own or with a second check, like a code from your phone. Others hold only part of the key and assume you still know your password, so read yours to see which kind you have.

Either way, a kit saved only on the phone you just lost won't help. Treat it like a spare house key, kept somewhere safe and separate.

A device that's still signed in

If your vault still opens on a phone or computer you've used before, you may not be locked out at all. Some managers let a trusted device, meaning one you've already set up and approved, reopen your vault without the master password. A few also let you use it to set a new master password or download a fresh recovery kit.

Email-based recovery and its tradeoff

Some services let you recover through your email or Google account, which can be a lifesaver if you tend to lose papers and files.

The tradeoff is that your vault no longer depends only on keys you hold. Depending on the design, a break-in at your email account, or at the company itself, could open a path into your vault that wasn't there before. Good services make this optional and explain the tradeoff plainly.

If you turn it on, protect that email with a strong, unique password and two-step verification, a second check at sign-in such as a code from an authenticator app (an app that shows a new code every 30 seconds).

If you have none of these

Then, honestly, the old vault is probably gone for good. That's the price of a system nobody else can open.

You can still rebuild: start a new vault, then reset your accounts one by one with each website's own "forgot password" link, starting with your email, since most other resets go there. Passwords saved in your browser or phone can speed this up.

How recovery works in Pinzen

Pinzen follows the same design. Your vault is encrypted in your browser and stored only in encrypted form, and your master phrase (its name for a master password) is never sent to the company, so nobody there can see or reset it.

If you forget it, there are three ways back in:

• The Recovery Kit. This file, saved during setup, is a complete spare key. Together with a passkey (which lets you approve with Face ID, a fingerprint, or your screen lock), an authenticator code, or one of the Kit's own one-time codes, it can reset a forgotten master phrase.
• A trusted device. Once a phone or computer is trusted, it reopens your vault without the master phrase. It can also download a fresh Recovery Kit if you've lost the original.
• Google email recovery, if you turned it on. Normally, even a copy of the company's database and server secrets isn't enough to decrypt your vault. This optional recovery is the exception, which is why it's labeled as a tradeoff.

You can also turn on extra-secure recovery, so the Kit can't reset your phrase without a passkey or authenticator too. That way a found or stolen Kit isn't enough by itself to reset your phrase, but you must keep that second item safe as well.

On the Free plan, your private vault is on one trusted device at a time, so the Recovery Kit matters even more. One honest limit applies to every plan: if you forget your phrase and have no Kit, no trusted device, and no Google email recovery, there's no way back into that vault.

Setup takes three steps: create your master phrase (the app can suggest four random words), save the Recovery Kit, and turn on approval with Face ID, a fingerprint, or an authenticator app. For more detail, see how the encryption works or answers to common questions.

Set up recovery today: a five-minute checklist

Do this now, while you still remember your master password. It works for any password manager.

1. Find your recovery options. In your manager's settings, look for "recovery kit," "emergency kit," or "account recovery," and check what each one can actually do.
2. Save the kit. Print it, download it, or both. Keep any digital copy somewhere that doesn't depend on your password manager, such as a USB drive.
3. Store a second copy elsewhere. For example, keep one in a fireproof box at home and another in a sealed envelope with someone you'd trust with your house key.
4. Add a second layer. If your manager supports passkeys or an authenticator app, turn one on. Keep any backup codes somewhere safe, not only on your phone.
5. Keep a trusted device. Make sure at least one phone or computer you use every day is set up and signed in.
6. Tell one other adult. They don't need your passwords, just where the kit is and what it's for.
7. Check once a year. Make sure the kit is still where you left it, and save a fresh one if your settings have changed.

Looking after a whole household? Walk through this list together, and see our guide on how to choose a family password manager.

Making a master phrase you won't forget

The best recovery plan is the one you never need. These habits help a master phrase stick.

• Use random words, not clever tricks. Four unrelated words picked by a generator, like "puddle anchor velvet ladder" (don't use this one), are far easier to remember than "T!9#xQ2." Words you choose yourself, like song lyrics or pet names, are easier to guess, which is why four random words work so well.
• Picture it. Turn the words into a silly scene, like an anchor sinking into a velvet puddle under a ladder. The odder, the better.
• Recall it on purpose. If Face ID or a trusted device usually opens your vault, you may rarely type your phrase, so say it to yourself every couple of weeks.
• Use it nowhere else. If you reuse it and another site leaks it, your vault's front door is exposed.

If you're starting fresh, you can create a free Pinzen vault and save your Recovery Kit as part of setup. Whichever manager you choose, sort out recovery on the first day.

Frequently asked questions

What happens if I forget my password manager's master password?

It depends on what you set up beforehand. A recovery kit, a device that's still signed in, or email recovery you turned on may get you back in so you can choose a new master password. Without any of these, the vault generally can't be opened by anyone, including the company, though you can still reset each website's password one by one.

Can a password manager company reset my master password?

Usually not, if the manager is well designed. Your vault is encrypted on your own device and the company never receives your actual master password, so it has no way to set a new one for you. Pinzen, for example, can't see or reset your master phrase, so recovery goes through your Recovery Kit, a trusted device, or optional Google email recovery.

Where should I store my recovery kit?

Somewhere safe that doesn't depend on your password manager. Good options include a fireproof box or locked drawer at home, a USB drive kept somewhere secure, or a sealed envelope with someone you trust. Keep a second copy in a different place, and don't email it to yourself or store it only inside the vault it protects.

Should I write down my master password?

For many families, yes, if you do it carefully. A paper copy in a safe or locked drawer is a reasonable safety net and far better than losing your vault. Don't keep it in your wallet or near your computer, and don't label it in a way that tells a stranger what it unlocks.