Recovery code
Self-service. You saved a one-time recovery code; use it to restore your own
access after forgetting your passphrase.
Organization recovery
Quorum-based. A group of custodians you choose can jointly recover a room when
the key-holder is gone — no single person, and never Kvelden, can do it alone.
Recovery code (self-service)
A recovery code is a long, random, one-time code you save somewhere safe (a password manager, a printed sheet in a safe). It is an independent way to unlock your own key — think of it as a spare key, not a backdoor. Entering it restores the same identity, so all of your existing room access stays intact.Treat your recovery code like a master password. Anyone who has both your recovery
code and an authenticated session to your account can unlock your vault. Store
it offline; Kvelden never sees it and cannot show it to you again.
Save your recovery code
1
Set up your vault
The first time you open a Zero-Knowledge or ZK Strict room, you choose a
passphrase and Enclave sets up your personal key.
2
Copy the recovery code
Immediately after, Enclave shows you a one-time recovery code (formatted like
ENC1-XXXXX-XXXXX-…). Copy or download it and store it somewhere safe.3
Confirm you've saved it
Tick the acknowledgement and continue. The code is shown once and cannot be
displayed again — if you lose it, generate a new one from your account settings.
Recover a forgotten passphrase
1
Choose “Forgot your passphrase?”
On the vault unlock screen (when you open a Zero-Knowledge room), select
Forgot your passphrase?
2
Enter your recovery code and a new passphrase
Paste your recovery code and choose a new passphrase. Everything is processed in
your browser.
3
You're back in
Your key is restored and re-protected with the new passphrase. Because your
identity is unchanged, every room you already had access to remains available — no
re-invitation or admin action needed.
Regenerate a recovery code
You can issue a fresh recovery code at any time from Account → Security — for example if you think your old code may have been exposed, or you never saved it. You’ll be asked for your current passphrase, and the new code replaces any previous one.External guests
Invited guests use the same mechanism inside their vault. A guest saves a recovery code when they first set up their vault, and can use Forgot your passphrase? in the guest portal to restore it — keeping access to every room you’ve shared with them.Organization recovery (custodian escrow)
A recovery code only helps the person who saved it. Organization recovery covers the other case: the colleague who set up a room has left, is unreachable, or is incapacitated — and the room still needs to be recovered. It works by distributing trust across a group of custodians you nominate. Recovery requires a quorum of them to cooperate (for example, any 3 of 5). No single custodian — and no one at Kvelden — can recover a room alone.Organization recovery is opt-in and set up by an Owner or Security
Officer. It is off until you enable it. When you do, an organization recovery key
is generated in the admin’s browser and split into shares — each share encrypted so
that only its assigned custodian can use it. The whole key never exists on Kvelden’s
servers in a usable form.
Set up organization recovery
1
Open Security → Organization Recovery
Available to Owners and Security Officers.
2
Choose custodians and a quorum
Pick the people who will hold recovery shares (they must be enrolled in
zero-knowledge), and set how many of them are required to approve a recovery — the
default is 3 of 5.
3
Finish setup
Enclave generates the recovery key in your browser, splits it, encrypts each share
to its custodian, and stores only the encrypted shares. You’re done.
Enable recovery for a room
Organization recovery protects a room only after that room’s key has been escrowed.1
Open the room's Members tab
A room admin opens the room and goes to Members.
2
Enable recovery
Select Enable recovery (or Re-escrow). The room’s current key is encrypted
to the organization recovery key and stored. This runs in the admin’s browser.
Run a recovery
When a room needs to be recovered for a specific user, an operator (an Owner or Security Officer) leads the ceremony:1
Start a recovery request
In Security → Organization Recovery, the operator selects the escrowed room and
the user who should regain access, and starts a request.
2
Custodians approve
Each custodian sees the pending request in their account and approves it. A quorum
(e.g. 3 of 5) must approve. Everything each custodian does happens in their own
browser.
3
Operator completes the recovery
Once enough custodians have approved, the operator completes the request. Their
browser reconstructs the room key from the approvals, re-grants access to the target
user, and finishes — all client-side.
If you’re a custodian
When someone starts a recovery you’re part of, you’ll find a request waiting in your account. Make sure your vault is unlocked, review the request, and approve it. Your browser releases your share only to that specific recovery operator — never to Kvelden, and never in a form the server can read. You never handle raw key material.How recovery preserves zero-knowledge
Neither mechanism gives Kvelden a way in:- Recovery codes are never sent to Kvelden. The server stores only a second encrypted copy of your key that your code unlocks — useless to anyone without it.
- Organization recovery distributes shares so that only a quorum of your chosen custodians, cooperating in their own browsers, can reconstruct a room key. Kvelden holds only encrypted shares it cannot combine.
- In both cases the passphrase, the recovery code, and every reconstructed key exist only in a browser and are never stored by Kvelden.