Emergency Kit and recovery

If you’ve lost every device, or simply aren’t near one, a new machine can join your account with the Emergency Kit (Account ID and Secret Key) plus your password. No old device has to be online.

Recover on a new machine

uv tool install 'keygrant[cloud]'
keygrant recover

It asks for the Account ID, the Secret Key (the A3-... string; case and dashes don’t matter) and your password. The machine joins as a full device, then:

keygrant sync

How it works

From your password and Secret Key, keygrant derives a recovery signing key on the device. The server only stores the public half. To recover, the new device derives the same key, signs a one-time challenge from the server, and the server checks the signature. It never sees the password or the Secret Key, so this stays zero-knowledge.

Accounts created before recovery existed

Accounts created before version 0.1.4 need recovery switched on once, from a device that’s already in the account:

keygrant cloud enable-recovery

Print the kit again

keygrant cloud kit

Keep it safe

The Emergency Kit plus your password is full access to your account: that’s what makes recovery possible. Keep it offline, on paper or in a password manager you trust, and never in a synced notes app or a chat.