Question

How does the recovery of a private vault in the Family account work

Forum|Forum|11 months ago
August 27, 2025
8 replies
281 views

I’m trying to wrap my head around how private vault recovery works when someone forgets their Master Password. From what I understand, the Master Password plus the Secret Key are used to lock and unlock the keys that actually protect all the vault data. The client device generates the Master Unlock Key each time a user accesses 1Password by providing the Master Password, which is combined with the Secret Key. The asymmetric keys that are kept securely encrypted on the server, right?

If the Master Password is lost, the user can’t generate the Master Unlock Key to obtain keys, so they can’t get into their private vault. At that point, the account organizer can start the recovery process.

What I don’t get is: what additional piece of information does the organizer and/or the server have that makes it possible to get back the keys needed to decrypt the vault?

I realize that the recovery process also involves extra safeguards, such as a secure email, which should keep outsiders locked out even if they somehow got the Secret Key. But if some piece of recovery data really is stored on the servers, what’s stopping a malicious insider from bypassing the email step and taking over the vault?

Could you point to documentation that explains this?

Thank you!

N

NCJayG

The recovery process resets the account secret key. The assumption would be that you have verified the user needing to be recovered, which I suspect is a non-issue for Family accounts. This resource should answer things: Recover accounts for family or team members | 1Password Support,

I

ivolvoAuthor

... and creates a new Master password. I understand this part. What happens after recovery is clear. Before recovery, a user doesn't have the keys to decrypt the vault content,
What I asked: what additional information does the process use to recover keys that decrypt the vault content?

I

ivolvoAuthor

No takers to explain this part? I hope it is not secret information

1P_Dave

1Password Employee

Hello @ivolvo! 👋

I'm sorry for the delayed reply! We explain the recovery process in detail in our security white paper in section 12: Restoring a user’s access to a vault. You can find that section on page 35 here.

Let me know if you have any questions after giving that a read.

-Dave

I

ivolvoAuthor

Dave,

It was quite refreshing to read such a well-written document, which clearly explains security design goals and means to achieve them. It instills higher confidence when you understand what to do and how to make it more secure from my personal point of view.

I believe I have a pretty good understanding of the recovery process. I understand the underlying risks associated with the recovery, and they seem reasonable.

Tell me if my statements are correct:

The server maintains the vault key in question encrypted with the recovery group public key. As such, the server could do nothing with it
The owner of the recovery group's public key can recover the vault key, but they have no access to the vault content and can’t take advantage of it. Besides, they would get this key only if there is the owner’s request to do so
(Not sure) After the recovery, the vault content will be reincrypted with a new key, so the possession of the old one is useless after that.
New Account password and Master Key will be used after recovery, so effectively the encrypted vault content is fresh and is free of the previous hacking attempts, if they took place

Now, what I don’t quite understand (I use the same names as in the documentation example: Bob, Carol, server)

(Major, Line 3-4 of the recovery process) How could the owner send a request after they lost a password? Is there a section that I missed that explains this part?
Carol could ask for the recovery outside the system, but how is it done within? The documentation also states that Carol starts by creating a new vault. How could she do it? Is their password replaced through the “Forget password” mechanism? That’s not clear
(Minor, Line 8 of the recovery process) Why does the server need to send Carol her public key just generated during the recovery process? I think it was meant to be: Bob who receives Carol’s new public key in order to create her wrapped vault key, right?
Within the system, all interactions happen between Bob/Server and Server/Carrol, never directly between Bob and Carrol

Thanks!

I

ivolvoAuthor

Thanks, the picture is mostly clear. Still a few questions left, mostly about what kind of interactions take place during recovery. My understanding is (using roles/names from the White Paper):
1. When Carol realizes that she lost a password, she reaches Bopb outside the 1Password application (she can't log into it anymore)
2. Bob initiates the recovery process that is fundamentally similar to "Forgot password" on a regular site. The email sent effectively allows Carol to log on to the 1Password server and create a new password, generate a Secret Key, and RSA keys.
3. After this is done, Bob initiates reencryption of the vault key with Carol's new public key that would allow her to obtain access to her vault.
4. Carol reencrypts all the keys and stores them in the server, and the loss is fully recovered without any changes to the wrapped vault

If all this is correct, I think I have only one question left: since the server never comes into possession of the vault encryption key, Bob must have it at some point and potentially should be capable of decrypting the vault content if it has its wrapped content. I realize that he should never be able to obtain it, but is it a potential vulnerability? BTW, that's the reason that I thought Carol's vault could be reencrypted with the new symmetric key, such that old keys don't work anymore

Thanks, Ilya

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO