Skip to main content
Emergency guide

Locked out? Let's get you back in.

Nobody at ZZPass can open your vault for you. That's the point. So the way back in is always something you set up yourself, and it's usually quicker than you'd think.

Forgot your primary password

Set a new one with Face ID.

  1. Open ZZPass on a device where Face ID or Touch ID unlock is turned on.
  2. After a wrong attempt, tap Recover Account? on the lock screen.
  3. Confirm with Face ID or Touch ID and set a new primary password.
Needs · Face ID or Touch ID on that deviceFree

No Face ID on any device? Your primary password is printed on your Emergency Kit. Recovery pauses during a lockout after too many wrong attempts, and after Face ID or Touch ID itself changes. The lockout lifts by itself: 30 seconds after five wrong tries, rising to 15 minutes after twelve. Full recovery guide →

The ZZPass lock screen after a wrong attempt, with a Recover Account? link.
Lost every device

Log in on a new one.

  1. On the new iPhone, iPad or Mac, sign in to your own iCloud and install ZZPass.
  2. Tap Log In, then Scan QR Code and point it at your printed Emergency Kit.
  3. Your email, Secret Key and primary password fill in, and your vault syncs from iCloud.
Needs · Your kit, or Secret Key and passwordFree

No kit to hand? Type your email, Secret Key and primary password yourself. Your vault only opens on a device signed in to your own iCloud. Emergency Kit help →

The ZZPass Log In screen with fields for email address, Secret Key and primary password, and a Scan QR Code button.
Away from your devices

Read it off your printed kit.

  1. Carry the full Emergency Kit, or keep it with someone you trust.
  2. Look the account up and type the password where you need it.
  3. Two-factor code needed? Enter the printed secret in any authenticator app.
Needs · The full kitPremium

Your vault itself only opens on a device signed in to your own iCloud, so the paper is what travels. How printing works →

The Emergency Kit screen in ZZPass, showing the email, Secret Key, primary password, QR code and a list of passwords ready to print.
Someone else needs in

That's what Emergency Access is for.

  1. Your trusted contact taps Request Access in their own ZZPass.
  2. You're told straight away, and can deny it during the wait you chose.
  3. If you don't answer, the vault opens for them when the wait runs out, and they can browse it from their own phone.
Needs · Set up beforehandPremium

It can't be set up after the fact, so this one is worth doing now. How Emergency Access works →

A trusted contact's Emergency Contacts screen: Alex Morgan, access locked, with a Request Access button.
Something to leave behind

Seal it in a TimeCapsule.

  1. Write a note, and add photos or files if you like.
  2. Pick a date, or a safety net that opens after a long silence from you.
  3. Share it with the people it's for, or keep it to yourself.
Free

A message, not your vault. For the vault itself, use Emergency Access. How TimeCapsules work →

A sealed TimeCapsule in ZZPass, showing when it opens.
Your Emergency Kit

One page that gets you back in.

This is what you print, from Security → Emergency Kit. Tap a part to see what it does.

Before you need it

Ten minutes, once.

Tick off what you've done. The first two cover a forgotten password and a lost phone, and both are free.

0/4READY

ten minutes, honestly

Honest limits

What we can't do for you.

A password manager that could rescue you from anything could also be forced to hand your vault to someone else. These are the trade-offs, stated plainly.

How ZZPass keeps it this way →

  • We can't reset your primary password. No backdoor, no master key, no support override. Face ID or Touch ID recovery and your printed kit are what stand in for it, and both are yours.
  • We can't read or recover your vault. Forget your primary password with neither Face ID or Touch ID unlock turned on nor a printed kit, and the data is gone by design.
  • We can't release Emergency Access early. The wait you set is the wait, and it has to be set up before the emergency.
  • A printed kit is a physical thing. It can be found, photographed or burned, which is why where you keep it matters.
  • Attachments and passkeys aren't printed. They stay in your vault and sync between your devices.
What costs what

The essentials are free.

Face ID or Touch ID recovery and a printed account kit, the two things that matter most, cost nothing.

Free

$0
  • Face ID and Touch ID recovery
  • Account Emergency Kit: email, Secret Key, primary password and QR code
  • Reprint any time
  • TimeCapsule

Premium

$2.99 / month or $29.99 / year
  • Everything in Free
  • Emergency Access with trusted contacts
  • The full Emergency Kit, with every password, note and two-factor secret
  • Unlimited shared groups and attachments
FAQ

Questions, answered.

What is the single most important thing to do?
Turn on Face ID or Touch ID unlock on your devices, then print your Account Emergency Kit and put it somewhere safe. Both are free, both take minutes, and between them they cover a forgotten password and the loss of every device you own.
Can ZZPass help me if I forget my primary password?
Not directly, because we never hold your key. What we can do is make sure you have your own routes back in: Face ID or Touch ID recovery on a device where you turned it on, and a printed kit that carries your password and Secret Key. Support can guide you through either, but cannot perform a reset.
Is my Secret Key enough on its own?
No. It encodes your encryption salt and pairs with your primary password. Together they restore your vault on a new device; on its own the key opens nothing. That is also why it is reasonably safe to keep as a printed document.
Does my Secret Key change if I change my password?
No. Your Secret Key stays the same, so the one on your kit keeps working, but the printed password does not. Reprint your kit after any password change. Changing your password also signs out your other devices.
What if someone finds my printed kit?
Treat it as a full compromise, because page 1 carries both halves of your recovery material. Change your primary password straight away: that signs out your other devices, and the Secret Key on the found copy opens nothing without the old password. Then print a fresh kit and store it better. If it was the full kit with your passwords, change the passwords for your most critical accounts as well.
Can I set up Emergency Access after something has happened?
No. It has to be configured while you still have access to your vault, because your trusted contact's ability to open it is established cryptographically at setup. This is the main reason to spend the ten minutes now.
How often should I revisit any of this?
Once a year is enough for most people, plus any time you change your primary password or add accounts you would hate to lose. Check that your printed kit is still where you think it is and still matches what the app shows.
Does any of this need a ZZPass server?
Recovery does not. Face ID or Touch ID recovery works on the device itself, and logging in on a new device needs only your iCloud and your kit. Emergency Access and shared TimeCapsule releases use our escrow, which holds only a sealed key and a release condition, never your content. A capsule you keep to yourself never goes near it.

RELATED HELPAccount recoveryEmergency Kit helpEnd-to-end encryption