When you create a vault, Kistvault generates a 256-bit secret and renders it as a short, grouped code in Crockford Base32 with a trailing checksum. That's your Recovery Kit. It's produced on your device, shown once, and never stored by the app.
The threat it solves
Genuine end-to-end encryption means the provider holds no key to your data. That's the whole point — and it's also the trap. Lose the one secret that opens the vault and, with most tools, your files are gone for good: no reset link, no support line, no backdoor. The Recovery Kit is the way out that keeps the privacy intact, because it's a key only you hold.
How it works
- Generated on-device. At vault creation, a CSPRNG produces the 256-bit
kit_secret. Kistvault shows it once and asks you to save it. - Stored offline, by you. Print it or write it down and keep it somewhere safe. The Kit also carries your vault ID, the format version, the creation date, and plain-language instructions.
- Opens a clean device. On a fresh install with your exported container present, you enter the Kit. Kistvault re-derives the recovery key and unlocks the vault.
The key difference
No hostage data. The Kit needs no server and no account, so it works offline and never expires. A built-in checksum catches a mistyped group before any decryption attempt — you're told "group 3 is off", not a useless "wrong key".
The crypto, in the open
Questions
Can I recover an encrypted vault if I forget the password?
With Kistvault, yes — your printed Recovery Kit opens the vault on a clean device even if you forget both your password and your pattern. This is unusual: most zero-knowledge vaults have no recovery path at all, so a forgotten password means the data is gone. Kistvault is recoverable by design without giving us any ability to see your files.
What exactly is the Kistvault Recovery Kit?
A printed sheet holding a 256-bit secret in Crockford Base32 with a checksum. It is generated on your device and never stored by Kistvault — there is no copy on any server. You print or write it down once and keep it somewhere safe, like a passport or a seed phrase.
If Kistvault can recover my vault, can Kistvault (or anyone else) read my files?
No. Recovery works only because you hold the Recovery Kit; the key lives on your paper, not on our servers. Kistvault runs no backend that could hold or see your content. Without your password, pattern, a paired device, or your Recovery Kit, the vault cannot be opened by anyone, including us.
What if I lose the Recovery Kit too?
If you have lost your password, your pattern, every paired device, and the Recovery Kit, the vault cannot be opened — there is no backdoor, by design. That is the trade-off of true zero-knowledge encryption, which is why the Kit is worth storing as carefully as a passport.