Forgot Your Master Password? What Happens Next

A password hint, a two-factor recovery code and a vault recovery code are not interchangeable. Start by identifying exactly which credential is missing and which recovery methods your provider supports.

First, Preserve Any Access That Still Works

Check whether a trusted phone, computer or browser extension can still open the vault using an existing session, a device PIN or biometrics. If it can, keep that device secure and avoid actions that might lock or reset it. This access may help you save essential information, but it does not guarantee that you can change the master password or export the vault without entering it.

• Confirm the correct account email address and, where applicable, the correct service region or server.
• Check keyboard layout, Caps Lock and accidental spaces before assuming the password is wrong. Avoid repeated guessing if the service warns about limits.
• Identify whether the prompt asks for the vault’s master password, the device passcode, a Secret Key or a two-factor authentication code.
• Look for your own securely stored recovery record or password hint. Do not share recovery material with someone who contacts you unexpectedly.

Use the provider’s official app or website to find help. Anyone promising to “decrypt any vault” or asking you to upload a full vault and recovery bundle deserves caution. A legitimate recovery route depends on the service’s design and the methods available to your account.

Check What Your Recovery Material Actually Does

• Master password or account password: the credential used in your vault’s sign-in or encryption process.
• Two-factor recovery code: commonly restores access past a missing second factor, but may still require the account password.
• Account or vault recovery code: a provider-specific recovery method that may require additional checks such as access to your email.
• Emergency document: may contain an account address, key and a place for you to write a password. Read its contents rather than assuming it is a complete recovery solution.
• Trusted helper or organisation recovery: available only under the provider’s rules and any configuration or eligibility requirements.

A recovery method shown in a help article is not necessarily enabled for your account. Check what was configured before the lockout and whether you can meet every step now.

If You Use Bitwarden

Bitwarden’s forgotten master password guidance explains that Bitwarden cannot simply reset the master password and recover an individual vault for you. Check any existing PIN or biometric unlock, your password hint, prearranged emergency access and eligible organisation recovery. Other configured routes, such as approval from a known device or an encryption-enabled login passkey, may also be relevant to your account.

Do not assume every login passkey can decrypt the vault. Likewise, an unlocked app may let you recover individual items while still requiring the master password for a bulk export. Preserve working access while checking the instructions for that client.

A Bitwarden two-step recovery code is different: using it requires your email address and master password as well as the code. It helps with a lost second factor, not a forgotten master password.

If you use that two-step recovery route successfully, previously configured two-step methods are deactivated and a new recovery code is generated. Re-enable appropriate protection and save the replacement code. It does not retrieve a forgotten master password. If your organisation requires two-step login, Bitwarden says using the recovery code removes you from the organisation. Restore two-step protection, reconnect required SSO and ask an authorised administrator to restore membership.

If You Use 1Password

For an eligible individual or family account with a 1Password recovery code already created, follow the recovery option from the sign-in screen. You need the recovery code and access to the account’s email for verification. The process lets you set a new account password and receive a new Secret Key; the code alone is not enough.

A family organiser may also be able to help recover your account. The account holder and organiser each have steps to complete, and recovery creates new sign-in credentials. If you are the only organiser, you cannot depend on another organiser to recover your own account.

Check your Emergency Kit if you have one. Its Secret Key is useful, but an unfilled password field does not reveal a forgotten account password. After a successful recovery, update your securely stored recovery record and follow the instructions to sign back in on your devices.

Check which 1Password recovery path you are taking. Code-based recovery keeps existing two-factor authentication enabled; organiser-assisted recovery resets it. A recovery code is therefore not a bypass for a missing second factor. 1Password also says to wait at least one hour after generating a recovery code before using it; a recovery attempt after a recent sign-in can be blocked and make the code unusable for 24 hours. Follow the actual status message instead of repeatedly submitting it.

Choose a Recovery Route That Matches the Failure

First distinguish a service or region mismatch from a missing secret. A valid password entered into the wrong account or server will not recover the intended vault. Use the account address and region recorded in your own recovery material, then identify the exact prompt. Do not turn a second-factor problem into a new-account reset merely because both prevent sign-in.

What you have	Useful next step	Important limit
An app still opens with a PIN or biometrics	Preserve that session and inspect accessible essential items	Local unlock does not necessarily authorise a bulk export or password change
The account password, but no second factor	Use the provider’s separate two-factor recovery route	A replacement code or restored membership may need follow-up
A configured vault recovery code or trusted helper	Check the account type, email access and any other required factor	A code, organiser or emergency contact has a specific role; none is universal
No usable vault recovery route	Recover essential service accounts individually before retiring the vault	Deleting the vault does not reset those service passwords

Avoid a Circular Recovery Plan

Check dependencies before triggering resets. If your email password is in the locked vault and the email account’s backup code is there too, neither is an available recovery route yet. Look for a protected offline record, a registered security key, a trusted signed-in device or the service’s own account-recovery process. Keep actual codes and passwords out of an ordinary task list.

For 1Password code-based recovery, confirm you can receive the verification email and complete any still-enabled second factor before relying on the code. An organiser-assisted recovery has different consequences and must be completed by both parties. After recovery, replace outdated sign-in details in your protected recovery record and check a fresh sign-in while another working session remains available.

If You Use Another Password Manager

Open the provider’s current recovery documentation and check the exact product and account type. Personal, family and workplace accounts may have different recovery arrangements. A biometric unlock, recovery key or administrator-assisted reset might be available in one situation and absent in another.

Contact official support when you need help identifying the applicable process. Do not interpret “reset password” as a promise that all encrypted data will survive: read the warning and confirm what the action does before proceeding.

If the vault belongs to your employer, involve the organisation’s authorised administrator. Do not export work credentials into a personal account or attempt to bypass the organisation’s access controls.

If the Vault Cannot Be Recovered

Losing the vault does not automatically mean losing every account whose password was stored there. Each website or app has its own recovery process, which may use an email address, phone, security key, recovery code or identity checks. Some accounts may still be unrecoverable if their required recovery methods are also missing.

1. Start with the email account used for other password resets. Preserve any working email session and check its recovery options.
2. Recover essential accounts through their official websites or apps. Prioritise accounts that control money, communications or other accounts.
3. Save newly reset credentials in a secure replacement vault or another protected temporary record that you can manage safely.
4. Check what else was stored in the old vault: passkeys, authenticator secrets, recovery codes, secure notes and attachments may need separate action.
5. Only consider deleting or replacing the old password manager account after you understand the consequences and have recovered everything still accessible.

Account deletion is not a harmless troubleshooting step. For example, Bitwarden warns that deleting an account removes its individual vault data. Avoid deleting a vault merely to reuse the same email address before you have exhausted the available recovery routes.

Reduce the Chance of Another Lockout

After access is restored, choose a strong, unique account password that you can reliably retain and follow the provider’s recommended recovery setup. Keep essential recovery information outside the vault in a protected location, and consider how you would retrieve it if your phone were lost.

Choose trusted helpers carefully. More recovery routes are not automatically better if they put sensitive access in the wrong hands. Our emergency access guide explains the difference between routine recovery and giving someone access when you cannot act.

For a household, configure recovery as part of setting up a family password manager. If the problem is a missing passkey after changing phones, use the passkey recovery guide rather than assuming a vault reset will solve it.

Build a Recovery Inventory Before Starting Over

Use a short list with four columns: essential service, working access, recovery route and next action. Record whether the needed email, phone, security key or backup code is available; do not paste the actual secrets into an ordinary spreadsheet. The purpose is to find dependencies. For example, resetting an account through an inbox you cannot open is not yet a usable plan.

Separate a vault lockout from a possible compromise. Forgetting a password alone does not prove that someone else has your vault. If the phone or recovery material is missing, or there are unfamiliar sessions, handle that exposure through the relevant provider’s security controls while pursuing recovery. Preserve working access without assuming an unattended unlocked device is safe.

If an app still opens, inspect what it can actually reveal or copy before assuming you have a complete backup. A local vault can contain older data, and notes, attachments, passkeys and authenticator secrets may not travel in a password-only export. Rescue essential accessible information using the provider’s supported process, protect any readable export, and verify it before removing the original account. Do not email the vault file to yourself as a shortcut.

When a service account must be recovered individually, open its official site and identify the correct username before requesting a reset. Save the successful replacement in one secure place, test it and mark that account resolved. Then review its recovery details and any active sessions as appropriate. This avoids cycling between contradictory old and new passwords while the remaining accounts are still unresolved.

Close the Recovery Without Creating the Next Lockout

Once access is restored, update recovery records to match the credentials now in use. Check email access, the available second factor and any trusted helper separately. Keep a protected recovery copy reachable without the very vault it is meant to recover. For essential accounts, confirm a fresh sign-in works before closing the last known working session. Only then decide whether an obsolete vault or account can safely be retired.

Frequently Asked Questions

Sources and Image Credits

Sources: Bitwarden master-password recovery; two-step recovery codes; 1Password recovery codes; organiser-assisted recovery; Emergency Kit.

Illustrations: Impulsec.

Share this article

WhatsAppLinkedInRedditFacebookX