Recovery checklist
Plan password-manager recovery and MFA
Set up recovery before an emergency, without creating an easy bypass for your strongest account.
Protect the account that protects the others
Your password manager concentrates risk, but it also makes unique credentials practical. Give it a unique master password or a long passphrase generated from a large word list. Do not reuse that secret for the manager’s email account.
Enable the strongest MFA the manager supports. A hardware security key or passkey is generally more resistant to phishing than a typed one-time code. Keep a second enrolled key in a separate secure place if the service permits it.
Build a recovery packet
- Download or print the manager’s official emergency kit, recovery code, or account identifier. Follow the product’s documentation; recovery models differ.
- Record the service name, sign-in address, recovery-code location, and where a spare security key is stored. Do not write the master password beside an unlocked device.
- Store one copy somewhere that survives loss of your phone and computer, such as a sealed paper copy in a secure physical location.
- If a trusted person may need emergency access, use the manager’s formal emergency-access feature where available. Explain the process without sending secrets in chat or email.
- Test the plan from a signed-out browser. Confirm that you can identify the account and locate recovery material, but do not consume a one-time recovery code merely for practice.
Avoid circular recovery
Map dependencies on paper: manager → email → phone number → device. If every recovery code exists only inside the locked manager, or the email account can only be opened with a password stored there, one lost device can lock the whole chain.
Keep device-lock codes, email recovery, and manager recovery distinct. Review enrolled devices, spare keys, trusted contacts, and printed codes after moving, changing phone numbers, or replacing hardware.