Key guardians: your recovery key in parts

Why split a recovery key

Anyone who holds your recovery key can open your vault, and Sealed’s printed key sheet says never to keep it in a photo, a message or an email. Because your key never reaches us, we cannot recover your vault or reset your passcode for you.

So the key has two jobs that pull against each other. It must be safe from other people, and it must still exist on the day you need it. One copy in one drawer does the first job and can fail the second. Key guardians give a third option: the key lives with several people, and none of them can use it alone.

How the split works

Key guardians split your recovery key into 3 parts where any 2 bring it back, or into 5 parts where any 3 do, one part for each person you trust.

One guardian’s part on its own tells nothing about your key.

So if one guardian loses their part, the others can still bring the key back. If one guardian is careless with theirs, it is no use to anyone on its own.

Choosing your guardians

Sealed suggests choosing guardians who don’t know each other, so they can’t get together without you.

• People who will still be in your life in five years. A part is only useful if you can reach the person who holds it.
• People who keep things. A part on paper in a desk drawer is fine. A part in a chat that gets deleted is not.
• Not people who live with you. A fire or a flood should not take every part at once.

Handing out the parts

1. In Sealed’s Settings, open Recovery Key under Sync & Backup, and tap Key Guardians.
2. Pick the set you want. You choose 2 of 3 or 3 of 5, tap Make the Parts, and each part can be sent, printed or saved as a PDF, or shown as a QR code.
3. Give each part to one person, one at a time.
4. Tell each guardian what the part is for, and that they should never send it to anyone who asks for it by message.

Sealed doesn’t keep the guardian parts: once you close the screen, they exist only where you sent them. Sealed tells you to keep your own recovery key too, because guardians are a way back and not a replacement.

Getting your key back

When you need your key back, the screens that ask for your recovery key offer Use guardian parts, where you paste each guardian’s part or scan its QR code, one at a time.

1. Ask enough guardians for their parts: two of the three, or three of the five.
2. Paste or scan each part as it arrives.
3. Once enough parts are in, the key is back, and the screen carries on as if you had typed it.

The same screens also take a sealed copy of the key, if you keep one.

When you replace your recovery key

You can make a new recovery key in Settings; the current one keeps working until the new one is saved and your next backup finishes, and anyone with the old key and an old copy of your backup could still open that copy.

Making a new recovery key retires every guardian part of the old key, and sealed copies of the old key stop working once the new key is saved and your next backup finishes.

So after a new key, make a new set of parts and ask your guardians to throw the old ones away. The recovery key checklist helps you check what you have.

Where Sealed helps, and where it doesn’t

It helps keep your recovery key alive without leaving it whole in one place. One guardian’s part on its own tells nothing about your key.

It doesn’t do these things:

• Keep the parts for you. Sealed doesn’t keep the guardian parts: once you close the screen, they exist only where you sent them.
• Stop guardians who team up. Enough of them together can bring the key back, which is the point. Sealed suggests choosing guardians who don’t know each other, so they can’t get together without you.
• Keep old parts working. Making a new recovery key retires every guardian part of the old key, and sealed copies of the old key stop working once the new key is saved and your next backup finishes.
• Give us a way in. Because your key never reaches us, we cannot recover your vault or reset your passcode for you.