A Recovery Kit is a printed, offline document that can open your encrypted vault on a brand-new device — even if you've forgotten your password and your pattern. It contains a high-entropy secret and the context needed to use that secret safely: which vault it belongs to, a checksum to catch typos, the container format version, and plain instructions. A bare seed phrase is just the secret. The Kit is the secret plus everything that makes it usable under stress. If you're reading this because you're already locked out, start with forgot your vault password — it walks through what to try, in order.
Why "just a seed phrase" falls short
Seed phrases work — they're a compact way to write down a cryptographic secret. But on their own they leave gaps that bite at exactly the wrong moment, when you're panicking on a new phone:
- Which vault does this open? If you keep more than one vault, or you find an old phrase in a drawer, a naked phrase doesn't tell you what it's for. A Kit carries a vault ID.
- Did I type it correctly? With a bare phrase, a single wrong character just produces "wrong key" after a slow key-derivation attempt — no clue where the mistake is. A Kit includes a checksum that flags the bad group before any decryption runs, so you're told "group 3 is off", not simply "no".
- Will it still work with a future version? A phrase says nothing about the format it was made for. A Kit records the format version, so the app knows exactly how to interpret it.
- What do I even do with this? A Kit prints instructions in plain language, because the person reading it may be future-you under pressure, or someone you trusted with access.
What's actually on a Kistvault Recovery Kit
Kistvault's Kit renders a 256-bit secret as a short, grouped code in Crockford Base32 (an alphabet chosen to avoid confusable characters like 0/O and 1/I), with a trailing checksum. Alongside the code it prints the vault ID, the format version, the creation date, and a short note explaining what the sheet does and the fact that anyone holding it can open the vault. It's generated on your device, shown once, and never stored by the app or sent anywhere.
The key idea
Recoverability can be a first-class guarantee without weakening privacy — as long as the recovery key lives on your paper, not on a company's server. The Kit is a key only you hold. That's the whole trick: you keep a way back in, and no one else gains one.
How a Recovery Kit is different from a backdoor
A backdoor is a key someone else holds — a provider key, a master key, a "law-enforcement" key. A Recovery Kit is the opposite: it's a copy of your key, in your custody, that the vendor never sees. That distinction is the entire difference between "recoverable" and "the company can read your files". A vault can be one without being the other.
How to store it well
- Print it, don't screenshot it. A screenshot lands in a photo library that often syncs to a cloud — exactly the place you were trying to avoid.
- Keep it where a burglar of your phone can't reach it. The Kit defends against losing access, not against someone who already has your paper. A safe, a locked drawer, or a bank box all work.
- Consider two copies in two locations if the vault is important — one at home, one elsewhere — balancing "can't lose it" against "can't let it leak".
- Tell the right person it exists. If you'd want a partner or executor to recover the vault one day, make sure they know where the Kit is, without necessarily reading it.
Questions
Is a Recovery Kit the same as a seed phrase?
No. A seed phrase is usually just the secret itself — a list of words. A Recovery Kit wraps that secret with the context needed to use it: which vault it opens, a checksum that catches typos before any decryption attempt, the container format version, and plain instructions. The secret is one line on the sheet; the Kit is the whole printable document.
Where should I store my Recovery Kit?
Treat it like a passport. Keep it offline — printed and in a safe, a locked drawer, or a safe-deposit box. Avoid photographing it into a cloud photo library or pasting it into notes that sync. Anyone who holds the Kit can open that vault, so store it where only you (and anyone you trust with the vault) can reach it.
If I lose the Recovery Kit, can the vault still be opened?
Yes, as long as you still know your password or pattern, or have a paired device. The Kit is one of several ways in, not the only one. If you lose every way in — password, pattern, all paired devices and the Kit — then nothing and no one can open the vault, by design.