A separate encrypted vault copy
Back up your Windows .passaryvault file or export a web vault to storage you control. A configured backup folder can hold an encrypted latest copy, but check its status and keep another independent copy.
Vault Recovery Policy
Passary cannot reset your master password or unlock a vault on your behalf. Recovery depends on the encrypted copies and unlock methods you prepared while you still had access.
What we can and cannot do
We can help you use your copies
Support and documentation can guide you through locating an exported vault, opening a recovery kit, checking a snapshot, or troubleshooting an import. We cannot supply a missing copy or its secret credentials.
We cannot bypass your vault
Passary has no provider-held root key, account reset, or password hint service that can decrypt your records. A strong password makes offline guessing harder, but no encryption scheme makes a stolen copy mathematically unbreakable.
V3 vaults use a random root key wrapped by a key derived from the master password and optional keyfile. The root key can also have explicitly enrolled local device grants. Those grants are device-specific access paths, not a provider recovery service.
Recovery copies you can prepare
A recovery kit
A .passarykit contains an encrypted V3 vault copy and restore instructions. It contains neither your master password nor your keyfile. Unlock it with the password, and any required keyfile, that protected the vault when the kit was created.
Local snapshots
Encrypted snapshots help reverse accidental changes. Browser snapshots live in the same browser storage as the vault and can disappear when site data is cleared. Export or copy one elsewhere before relying on it for device-loss recovery.
An older credential copy
After a password or keyfile change, Passary may retain a local encrypted copy of the previous credential envelope. If it is still available and you know the older credentials, it may help restore access. It is not a permanent or independent backup.
A recovery plan that survives device loss
- Use a long, unique master password. Keep a secure record of it if relying on memory alone would risk losing access.
- If your vault requires a keyfile, keep an exact copy in a separate secure location. A recovery kit records a fingerprint, not the keyfile bytes.
- Keep at least one encrypted vault file or recovery kit outside the browser and separate from the primary device. Choose any cloud or external storage deliberately; the copy remains encrypted, but its location and metadata may be visible to that provider.
- Check that backups completed and periodically test opening one with the credentials that protected that particular copy. Verification and a real restore test provide stronger evidence than seeing a file name alone.
- After changing your password or keyfile, update your documented recovery path. Older copies may still need the previous credentials.
Selected-folder backups depend on folder access and successful writes. Sync is not automatically a backup: a remote copy can be unavailable, deleted, or older than your current vault.
If you lose access
First, avoid overwriting your remaining vault files, backups, or browser data. Identify the newest copy you can actually open, and note which password and keyfile were in use when it was made. If you recently changed credentials, check whether a previous credential copy is still available. An already enrolled Windows Hello device unlock may offer access on that Windows profile, but it is not portable recovery and should not replace an independent backup.
If no usable encrypted copy and matching unlock path remain, Passary cannot reconstruct the vault. You may need to create a new vault and recover individual accounts through those services' own recovery processes.