Forgot your master password? How the Recovery Kit works

By the TriPass team · Published 12 October 2026 · General security information, not a guarantee about any product.

Why there is no reset email

Your vault is encrypted on your device with a key made from your master password, and we never receive that password or key. A reset email could only work if we held something that opens your vault, and then anyone who got into our systems, or into your email, could open it too. So TriPass has no password reset. The Recovery Kit is the replacement, and it stays in your hands.

What the Recovery Kit is

When you create a TriPass account, your device generates a random code and shows it to you once. It looks like TP-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX: 25 characters, about 125 bits of randomness, far beyond guessing. The letters I, L, O and U are never used, so if you wrote one down it was a 1, 1, 0 or V.

Your device uses the code to lock a copy of your vault key. We store that locked copy and a value that lets us check you have the code, but never the code itself. That is why we can’t show it to you again.

How to use it

1. On your iPhone: on the sign-in screen, tap Forgot your master password? On the web: go to Accounts and choose Forgot password.
2. Enter your email address and your Recovery Kit code. Dashes, spaces and capitals don’t matter.
3. Choose a new master password. Your vault, cards and 2FA codes are re-encrypted under it, on your device.
4. Save the new Recovery Kit you are shown. The code you just used stops working.

To stop anyone trying codes at random, there are 10 attempts an hour per account.

Where to keep it

• On paper, somewhere safe at home, or in a place you would also keep important documents.
• Or in a different, trusted place you can reach if your phone is gone, such as another password manager or a family member you trust.
• Not only on the phone. The Recovery Kit is for the day the phone, or your memory of the master password, is gone.
• Treat it like your vault: anyone with the code and your email can take over the account.

Lost the code, but still know your master password?

Make a new one straight away: in the app, open Tools, then Recovery Kit, and choose Replace my Recovery Kit. The old code stops working.

Lost both?

Then nobody can open the vault, including us. That is the cost of a design where the company can’t read your data. You can still delete the account and start again, but the saved items are gone. If you also kept a password-protected backup file from the app, you can restore from that with its own password.

Without an account, there is no Recovery Kit at all: your vault exists only on your phone. See how the encryption works and the FAQ.

Sources

• TriPass Security: how the Recovery Kit and vault key are protected
• OWASP Forgot Password Cheat Sheet