Account Recovery in ZZPass
Your ZZPass primary password is the key to your encrypted vault. Because ZZPass uses end-to-end encryption with a zero-knowledge architecture, we cannot reset your password for you. This guide explains how account recovery works in ZZPass and what you need to do to prepare for the possibility of forgetting your primary password.
🔑 Why Recovery is Different
Zero-Knowledge Security
ZZPass uses end-to-end encryption, meaning your passwords are encrypted on your device before syncing. Your primary password never leaves your device, and we have no way to decrypt your data without it.
No Traditional Password Reset
Unlike typical online services, ZZPass cannot send you a "reset password" email that gives you access to your account. This is by design - it ensures that nobody, including ZZPass employees, can access your encrypted passwords.
🛟 Your Secret Key
What is a Secret Key?
Your Secret Key is generated when you create your ZZPass account. Combined with your primary password, it is what restores your vault on a new device. On its own it opens nothing: both halves are required.
Format: a prefixed, human-readable code:
Z1-XXXX-XXXX-XXXX-XXXX
Your Secret Key is generated locally on your device and encodes a 128-bit random salt. It is never stored on ZZPass servers.
⚠️ Critical: Save Your Secret Key
When You First Set Up ZZPass
You'll be shown your Secret Key and prompted to save it. Save it then: you can view it again later under Settings → Account → View Secret Key, but only from a vault you can already unlock. ZZPass keeps no copy, so if you are locked out there is nothing for us to send you.
Two different problems
Your Secret Key and your primary password cover different failures. Lost or replaced every device, but you still know your password? Your Secret Key restores the vault. Forgotten your primary password? The key alone cannot help, so you need either biometric recovery or your printed Emergency Kit, which carries both halves on one page.
What Happens if You Lose It?
Without your Secret Key you cannot set the account up again from scratch, so keep a copy somewhere you will still be able to reach in years.
This is not a limitation - it's a security feature. The alternative would be to give someone else (like ZZPass) the ability to access your passwords, which would defeat the purpose of encryption.
Finding Your Secret Key
📱 On iPhone or iPad
1. Open ZZPass app
2. Tap Settings (gear icon)
3. Tap Account
4. Tap View Secret Key
5. Authenticate with Face ID, Touch ID, or your primary password
6. Your Secret Key will be displayed
Tip: Tap the Copy button to copy your Secret Key, or tap Share to save it securely (e.g., to Files, Notes, or another secure location).
💻 On Mac
1. Open ZZPass for Mac
2. Go to ZZPass → Settings (or press ⌘,)
3. Click Account
4. Click View Secret Key
5. Authenticate with Touch ID or your primary password
6. Your Secret Key will be displayed
Tip: Click Copy to Clipboard to copy your Secret Key, or use Print to create a physical backup.
📝 During Initial Setup
When you first create your ZZPass account, you'll see a screen displaying your Secret Key with options to:
• Copy the key to your clipboard
• Save to Files (iOS) or Save to Finder (macOS)
• Print a physical copy
• Take a screenshot (not recommended for security reasons)
You cannot finish setup until you confirm you've saved it.
Restoring Your Account on a New Device
Step 1: Start Recovery
On iPhone, iPad, or Mac:
1. Install ZZPass on the device
2. Choose Recover Account
3. Have both your Secret Key and your primary password to hand
If you have forgotten your primary password, you need it from somewhere before this route works: your printed Emergency Kit has it, or use biometric recovery.
Step 2: Enter Your Secret Key
1. Enter your Secret Key
2. The format includes the Z1 prefix and dashes (Z1-XXXX-XXXX-XXXX-XXXX)
3. Secret Keys are case-insensitive
4. Tap/click Verify Secret Key
Note: You have unlimited attempts to enter your Secret Key. If the key doesn't work, double-check for typos or missing characters.
Step 3: Enter Your Primary Password
The Secret Key supplies your encryption salt. Your primary password supplies the rest:
1. Enter your primary password
2. The two together derive your encryption key on the device
3. Your vault decrypts and syncs
Neither half is any use without the other, which is why the Secret Key is safe to store as a printed document and why your primary password still matters.
Best Practices for Storing Your Secret Key
✅ Recommended Storage Methods
1. Physical Backup (Most Secure)
Print your Secret Key and store it in a secure physical location like a safe, safety deposit box, or locked filing cabinet.
2. Encrypted Cloud Storage
Save your Secret Key to an encrypted file in iCloud Drive, Google Drive, or Dropbox. Use a separate password for the encrypted file.
3. Password-Protected Document
Store your Secret Key in a password-protected PDF or encrypted note. Use a different password than your ZZPass primary password.
4. Split Storage
Write down the first half in one location and the second half in another location. This way, if one location is compromised, your full key is still safe.
❌ What NOT to Do
Don't store your Secret Key in:
• Unencrypted notes on your phone or computer
• Email (even draft emails)
• Text messages or messaging apps
• Screenshots saved to your photo library
• Shared cloud folders
• Browser bookmarks or auto-fill
Don't share your Secret Key with:
• Anyone claiming to be from ZZPass support
• Family members (unless you explicitly trust them with full access)
• Tech support or IT departments
🔄 Multiple Copies are OK
Redundancy is Good
It's actually recommended to keep multiple copies of your Secret Key in different secure locations. This protects against losing access due to a single point of failure.
Example Strategy:
• One printed copy in your home safe
• One in a safety deposit box
• One encrypted digital copy in cloud storage
Balance Security and Accessibility:
Your Secret Key should be secure enough that unauthorized people can't access it, but accessible enough that you can retrieve it when needed.
Preventing Account Lockout
🧠 Remember Your Primary Password
Use a Memorable Passphrase
Instead of a random password like "xK9#mP2!", use a passphrase like "correct-horse-battery-staple" (but more personal and memorable to you).
Examples of Good Passphrases:
• "BlueSky-CoffeeMug-2024-Sunshine"
• "MyDog-Loves-ChaseSquirrels"
• "Pizza-Friday-Movie-Night"
Make it long (12+ characters), personal, and easy for you to remember but hard for others to guess.
🔐 Turn On Biometric Recovery
Two separate features
Biometric unlock saves you typing your primary password every time you open the app. Biometric recovery is different, and it is the one that prevents lockout: with it enabled, you can set a new primary password using Face ID or Touch ID on a trusted device, without your Secret Key.
This is the single best thing you can do here. It is the one route back in that does not depend on a document you have to keep track of for years. It is one account-level setting rather than something you turn on per device, so enabling it once covers the account.
Even so, ZZPass never gains the ability to reset your password. Recovery runs on hardware you already control.
Your primary password is still needed after a device restart, and for exporting your vault. Using biometrics daily also means you type the password rarely, so keep it somewhere you can find it.
✍️ Practice Entering Your Password
Regularly Type Your Password
Biometric unlock means you may go months without typing your primary password. Enter it by hand now and then so it stays in muscle memory.
Test Secret Key Access
Every few months, go to Settings → Account → View Secret Key and verify you can retrieve it. This ensures you know where it's stored and can access it when needed.
Review Your Storage Method
Make sure your Secret Key storage location is still valid:
• Physical copy still in safe?
• Cloud file still accessible?
• Password for encrypted file still remembered?
What ZZPass Support Cannot Do
We Cannot Reset Your Password
Due to our zero-knowledge architecture, ZZPass support cannot reset your primary password or provide you with your Secret Key. We have no access to this information.
We Cannot Decrypt Your Vault
Your passwords are encrypted with your primary password as the key. Nothing we hold can decrypt them, so everything you need has to come from your side: biometric recovery, or your printed Emergency Kit, which carries your primary password and Secret Key together.
We Cannot Bypass Recovery Requirements
There are no backdoors and no master keys. Only two things can stand in for a forgotten primary password: biometric recovery, and the Emergency Kit you printed yourself.
What We Can Help With:
• Technical issues with the app
• Guidance on the recovery process
• Troubleshooting sync issues
• Questions about how features work
If Every Route Back Is Gone
Check these first
Starting over is only correct once all of these are genuinely gone:
1. Biometric recovery. If you enabled it, open ZZPass on a trusted device and use Face ID or Touch ID to set a new primary password. Try this before anything else, and do not delete the app from that device, because the recovery depends on it.
2. Your primary password. Try the passphrases you have used elsewhere. There is no limit on attempts. If it comes back to you, your Secret Key will restore the vault on any device.
3. A device that is still unlocked. Any device where ZZPass still opens can change your primary password from Settings, and show your Secret Key, while you are still signed in. Do this before wiping anything.
4. Your printed Emergency Kit. Every account can print one, and it carries your email, Secret Key, and primary password together, which is everything needed to restore the vault. Check the safe before you conclude it is gone.
Starting Over
Only if both fail: create a new ZZPass account and start fresh. This gives you a new, empty vault, and your old one stays sealed for good. It cannot be undone, so exhaust the list above first.
How to Create a New Account:
1. Delete the ZZPass app from all your devices
2. Reinstall ZZPass from the App Store, or download the Mac app from zzpass.com
3. Choose Create New Account
4. Set up a new primary password
5. SAVE YOUR NEW SECRET KEY in multiple secure locations
Your Old Vault
Your old, encrypted vault will remain in iCloud but will be inaccessible. It takes up minimal storage space and will be automatically deleted after 180 days of inactivity.
Important: Learn from this experience. With your new account, make absolutely certain you save your Secret Key in multiple secure locations and use a memorable primary password.
Common Questions
Can I change my Secret Key?
Yes, if you ask for one. When you change your primary password there is a checkbox to generate a new Secret Key at the same time. Leave it unticked and your existing key keeps working.
If you do tick it, save the new key and reprint your Emergency Kit. The old printed copy stops working the moment the new key is issued.
How long is my Secret Key valid?
Your Secret Key does not expire. Even if you don't use ZZPass for years, it will still work.
It changes only when you choose to replace it, using the checkbox offered when you change your primary password. A routine password change on its own leaves it untouched.
What if someone steals my Secret Key?
On its own, not much. A Secret Key without your primary password cannot open your vault or reset anything. It is one of the two halves, so an exposed key means an attacker now needs only your password rather than both.
If you believe your Secret Key has been exposed:
1. Sign in with your current primary password
2. Change your primary password, ticking the box to generate a new Secret Key
3. Save the new key and destroy the exposed copy
4. Reprint your Emergency Kit, since the old one now carries a dead key
Can I use account recovery on a different device?
Yes. Your Secret Key and primary password will restore the account on any device where ZZPass is installed, and the process is the same on iPhone, iPad, and Mac.
You keep your existing primary password: this route restores access rather than resetting anything. Your vault then syncs to your other devices via iCloud, if enabled.
Is my Secret Key backed up to iCloud?
No. Your Secret Key is never synced to iCloud or any other cloud service. It exists only:
• On the device where you created your account
• In the locations where you manually saved it
This is for security - if your Secret Key were automatically backed up, it could potentially be compromised if your iCloud account were hacked.
Do I need my Secret Key to add a new device?
Yes. Setting the account up on a new device needs your Secret Key alongside your primary password, because the key carries the salt your encryption key is derived from.
To add a new device:
1. Install ZZPass on the new device
2. Choose Recover Account
3. Enter your Secret Key, then your primary password
4. Your vault decrypts and syncs via iCloud