Forgot Your Master Password? What Happens Next

If you forget your master password, you may lose access to your password vault unless you have another working unlock method or a recovery option that was set up beforehand. What happens next depends on the password manager. Do not delete your account, reinstall the app or sign out of a working device while you check your options.

A password hint, a two-factor recovery code and a vault recovery code are not interchangeable. Start by identifying exactly which credential is missing and which recovery methods your provider supports.

First, Preserve Any Access That Still Works

Check whether a trusted phone, computer or browser extension can still open the vault using an existing session, a device PIN or biometrics. If it can, keep that device secure and avoid actions that might lock or reset it. This access may help you save essential information, but it does not guarantee that you can change the master password or export the vault without entering it.

• Confirm the correct account email address and, where applicable, the correct service region or server.
• Check keyboard layout, Caps Lock and accidental spaces before assuming the password is wrong. Avoid repeated guessing if the service warns about limits.
• Identify whether the prompt asks for the vault’s master password, the device passcode, a Secret Key or a two-factor authentication code.
• Look for your own securely stored recovery record or password hint. Do not share recovery material with someone who contacts you unexpectedly.

Use the provider’s official app or website to find help. Anyone promising to “decrypt any vault” or asking you to upload a full vault and recovery bundle deserves caution. A legitimate recovery route depends on the service’s design and the methods available to your account.

Check What Your Recovery Material Actually Does

• Master password or account password: the credential used in your vault’s sign-in or encryption process.
• Two-factor recovery code: commonly restores access past a missing second factor, but may still require the account password.
• Account or vault recovery code: a provider-specific recovery method that may require additional checks such as access to your email.
• Emergency document: may contain an account address, key and a place for you to write a password. Read its contents rather than assuming it is a complete recovery solution.
• Trusted helper or organisation recovery: available only under the provider’s rules and any configuration or eligibility requirements.

A recovery method shown in a help article is not necessarily enabled for your account. Check what was configured before the lockout and whether you can meet every step now.

If You Use Bitwarden

Bitwarden’s forgotten master password guidance explains that Bitwarden cannot simply reset the master password and recover an individual vault for you. Check any existing PIN or biometric unlock, your password hint, prearranged emergency access and eligible organisation recovery. Other configured routes, such as approval from a known device or an encryption-enabled login passkey, may also be relevant to your account.

Do not assume every login passkey can decrypt the vault. Likewise, an unlocked app may let you recover individual items while still requiring the master password for a bulk export. Preserve working access while checking the instructions for that client.

A Bitwarden two-step recovery code is different: using it requires your email address and master password as well as the code. It helps with a lost second factor, not a forgotten master password.

If You Use 1Password

For an eligible individual or family account with a 1Password recovery code already created, follow the recovery option from the sign-in screen. You need the recovery code and access to the account’s email for verification. The process lets you set a new account password and receive a new Secret Key; the code alone is not enough.

A family organiser may also be able to help recover your account. The account holder and organiser each have steps to complete, and recovery creates new sign-in credentials. If you are the only organiser, you cannot depend on another organiser to recover your own account.

Check your Emergency Kit if you have one. Its Secret Key is useful, but an unfilled password field does not reveal a forgotten account password. After a successful recovery, update your securely stored recovery record and follow the instructions to sign back in on your devices.

If You Use Another Password Manager

Open the provider’s current recovery documentation and check the exact product and account type. Personal, family and workplace accounts may have different recovery arrangements. A biometric unlock, recovery key or administrator-assisted reset might be available in one situation and absent in another.

Contact official support when you need help identifying the applicable process. Do not interpret “reset password” as a promise that all encrypted data will survive: read the warning and confirm what the action does before proceeding.

If the vault belongs to your employer, involve the organisation’s authorised administrator. Do not export work credentials into a personal account or attempt to bypass the organisation’s access controls.

If the Vault Cannot Be Recovered

Losing the vault does not automatically mean losing every account whose password was stored there. Each website or app has its own recovery process, which may use an email address, phone, security key, recovery code or identity checks. Some accounts may still be unrecoverable if their required recovery methods are also missing.

1. Start with the email account used for other password resets. Preserve any working email session and check its recovery options.
2. Recover essential accounts through their official websites or apps. Prioritise accounts that control money, communications or other accounts.
3. Save newly reset credentials in a secure replacement vault or another protected temporary record that you can manage safely.
4. Check what else was stored in the old vault: passkeys, authenticator secrets, recovery codes, secure notes and attachments may need separate action.
5. Only consider deleting or replacing the old password manager account after you understand the consequences and have recovered everything still accessible.

Account deletion is not a harmless troubleshooting step. For example, Bitwarden warns that deleting an account removes its individual vault data. Avoid deleting a vault merely to reuse the same email address before you have exhausted the available recovery routes.

Reduce the Chance of Another Lockout

After access is restored, choose a strong, unique account password that you can reliably retain and follow the provider’s recommended recovery setup. Keep essential recovery information outside the vault in a protected location, and consider how you would retrieve it if your phone were lost.

Choose trusted helpers carefully. More recovery routes are not automatically better if they put sensitive access in the wrong hands. Our emergency access guide explains the difference between routine recovery and giving someone access when you cannot act.

For a household, configure recovery as part of setting up a family password manager. If the problem is a missing passkey after changing phones, use the passkey recovery guide rather than assuming a vault reset will solve it.

Frequently Asked Questions

Share this article

WhatsAppLinkedInRedditFacebookX