Emergency Recovery & Master Key Backup

Because Vertueal operates on a strict Zero-Knowledge Architecture, our engineers and support staff cannot reset your master password or decrypt your vault. If you lose or forget your master password, your Emergency Recovery Key is your sole method of regaining access.

---

How the Emergency Recovery Key Works

When you create your vault or reset your security settings, Vertueal generates an offline recovery kit using Key Wrapping Cryptography:

1. Entropy Generation: A 32-byte cryptographically secure random key (displayed as a 64-character hexadecimal string) is generated in your browser.
2. Key Wrapping: A Key Wrapping Key (KWK) is derived from this string via PBKDF2 (100,000 iterations).
3. Payload Packaging: Your active Master Encryption Key (MEK) and account authentication hash are encrypted with the KWK and stored in the database as a recovery_blob.
4. Offline Secrecy: The recovery key itself is displayed once to you and is never transmitted to the server.

---

Restoring Access with Your Recovery Key

If you have forgotten your master password:

Step 1: Initiate Recovery

1. Open the Vertueal Password Manager login screen.
2. Authenticate with your Authentic Profile account.
3. On the Enter Master Password prompt, click Forgot Master Password? or Recover with Emergency Key.

Step 2: Provide Your Recovery Key

1. Retrieve your physical or digital copy of the 64-character hexadecimal key.
2. Carefully paste or type the key into the Emergency Recovery Key input field.
3. Click Unlock with Recovery Key.

Step 3: Establish a New Master Password

1. Your browser Web Worker unwraps the recovery_blob, decrypts your MEK, and verifies your account.
2. You will be prompted to enter a New Master Password.
3. Confirm your new master password and click Re-Encrypt Vault.
4. The system automatically re-encrypts your vault, updates your server authentication hash, and prompts you to generate a fresh Emergency Recovery Kit.

---

Best Practices for Storing Your Recovery Key