Your recovery phrase

Your recovery phrase is 24 words, shown once when you first set up your identity key. It’s one of the two ways to unlock your key — the other being a PRF-capable passkey.

When you type it, the first four letters of each word are enough, and spaces and capitals don’t matter. A built-in check catches a mistyped word before anything is sent.

What it does

Unlocks your identity key on a new browser or device. Sign in, choose to unlock with your recovery code, and previously submitted requests become readable again.
Is your safety net if you lose your passkey. On the Keys page choose Add a passkey, then Lost your passkey? Use your recovery code instead: the code confirms it’s you in place of an existing passkey. Once the new passkey is added, remove the lost one.

What it can’t do

The recovery code is never stored by SafeHanded in a form we can use — like your key, we hold only material we can’t read. If you lose it and have no PRF passkey enrolled, we cannot recover it for you.

Testing it

Every few months SafeHanded asks you to test your recovery phrase, so you find out it’s missing while you can still make a new one. On the Keys page choose Test your recovery phrase and type it from wherever you keep it. Nothing is unlocked or changed; SafeHanded only notes that it still works. A wrong attempt counts towards the same limit as a real unlock.

Keeping it safe

Store it in your password manager, or print the downloaded file and keep it somewhere secure.
Don’t paste it into chat, tickets or email.
Add a PRF-capable passkey as a second unlock method as soon as you can, so a lost code isn’t a lock-out. A passkey on a second device (phone and laptop) helps too.

If you lose your recovery phrase and every passkey

Nobody can open your key then: not you, not an admin, not SafeHanded. That is the zero-knowledge promise working as designed. What you can do is start over with a new key, so that what is sent to you from now on reaches you again.

On the unlock screen, choose Lost your recovery phrase and every passkey?
The Start over with a new key page shows, for each organisation you belong to, what you lose: submitted credentials only your key can open (lost for good), those the organisation recovery key or other recipients can still open, open links that will need a new link, and shares whose saved key can no longer be opened.
Confirm it’s you. Choose Sign in again: Microsoft or your organisation’s sign-in asks for your password again, and must tell SafeHanded you just entered it. If you sign in with an email link or a passkey, choose Email me a link instead. Open emailed links in the same browser.
If you are the only Owner or Admin of an organisation, choose Text me a code and enter the code we text to the mobile number on your account (see below), then Check the code. Someone who has only your email can’t do this step.
Type start over and choose Start over with a new key.
Your old key is paused and your other browsers and sessions are signed out. Set up your new key, recovery phrase and passkey as you did the first time. If you still have a passkey that only signs you in, keep it.

Afterwards:

We email you a summary with a This wasn’t me link, and tell the Owners and Admins of each organisation by email and in the app.
Open links that only you could read stop at once, and the people who sent them are told; they send a new link once your new key is in use.
In each organisation someone checks your new key’s fingerprint with you and approves it (see Approving a replacement key): another Owner if you are an Owner, otherwise an Owner or Admin, who held that role for at least seven days before you started over, and not someone you invited or promoted yourself. Even once approved, your new key receives nothing until 72 hours after you started over; then open requests that named you move to it. Until then colleagues see that your key changed, and you can’t create requests (“Your key isn’t verified yet…”). If you have a mobile number on your account, we text it when you start, at each approval and when the new key takes over.
If nobody there can approve it (for example you are the only Owner), your new key starts working 72 hours after you start over, and nobody can approve it sooner. We email you and text your mobile when you start, after 24 hours and at the end, each time with a This wasn’t me link. If your organisation has verified a domain, your account email must be on it; otherwise the page asks you to contact support.
You can start over once every 30 days. An Owner or Admin can allow another sooner from the Members page (Allow another start-over).

Starting over never brings back what the old key could open. That is what the organisation recovery key is for, if your organisation set one up.

Found your old key after all?

Until your new key takes over (at the earliest 72 hours after you started over), your old key is only paused: nothing is deleted. If your recovery phrase turns up, or a passkey or a browser can still open your old key, use it:

On the unlock screen or the key set-up page, use Use your previous key: Unlock with your previous passkey, or type your phrase and choose Use your previous recovery phrase.
A browser that still remembers your old key does this by itself the next time you open SafeHanded in it.

The start-over is then cancelled straight away: “Your existing key was used, so the start-over was cancelled. Your key is back as it was, and the new one will never be used.” Everything your old key could open is yours again, other sessions are signed out, and you and your organisation’s Owners and Admins are emailed. If you lost your recovery phrase, make a new one on the Keys page now. Once the new key is in use, the old key’s copies are deleted and this is no longer possible.

A mobile number for account security

If you are the only Owner or Admin of an organisation, starting over also needs a code texted to the mobile number on your account, which must have been confirmed at least 7 days before. Add it now, while you can still open your vault: Keys and passkeys → Mobile for account security → Add a mobile number. You may be asked to open your vault first; then enter the number, choose Text me a code, and enter the code with Confirm number. Only someone who can open your vault can add, change or remove it, so someone with only your email can’t put their own number there.

If you have no such number when you need to start over, the page says “…there is no mobile number on your account that was confirmed at least 7 days ago, so you cannot start over on your own. Contact SafeHanded support.” Support will confirm who you are before helping you start over. Organisations where another Owner or Admin can approve your key need no text message.