Your master password opens your vault. Your recovery key replaces it if you forget it. With sync on, the master password is also your sync account's password, and the recovery key is your sync account's way back in.
Choosing a master password
It must be at least 8 characters. A passphrase of four or more random words is easier to remember and harder to guess than a short complex password. MorphGate never sends it anywhere and can't recover it.
Your recovery key
MorphGate shows the recovery key once, when you create your vault: 56 characters in groups of four. Store it away from your computer, on paper or in another password manager.
- It is the only way to set a new master password when you've forgotten the old one.
- When you type it, case and dashes don't matter, and a typo is caught instead of silently producing a wrong key.
- With sync on, it also signs you in on a new device when you've forgotten the password, and it turns off two-step verification if you've lost your authenticator.
Change your master password
- Open Security (the shield at the top of the sidebar).
- Under Master password, enter the Current master password, then the New master password twice.
- Choose Change master password.
Only the key that protects your vault is re-encrypted; your hosts and keys stay as they are.
With sync on, this needs a connection. The new password is set on the sync server first, then on this device. Your other devices are signed out of sync. Until you sign in again on each of them, they still open with the old password. When you sign in there with the new password, that device's vault switches to the new password too. On morphgate.com, your verified address gets an email saying the password changed.
Make a new recovery key
If you lost your recovery key, or think someone saw it, make a new one:
- In Security, under Recovery key, enter your master password.
- Choose Create a new recovery key, store the new key, and tick that you stored it.
The old key stops working at once, with sync on also on the server. Nobody is signed out. On morphgate.com, you get an email saying the recovery key was replaced.
Forgot your master password
On a device that has your vault
- On the unlock screen, choose Forgot password? Use your recovery key.
- Enter the recovery key and choose a new master password.
- Choose Set new password.
Without sync, only this vault changes. With sync on, the new password is set on the sync server too, which needs a connection. Then:
- every other device is signed out of sync and asks for the new password; this device signs back in by itself;
- two-step verification is turned off, in case the reason you're recovering is a lost authenticator; turn it on again under Sync;
- on morphgate.com, your verified address gets an email saying the recovery key was used.
On a new device
On the first-run screen, choose Already use MorphGate sync? Sign in, then Forgot the master password? Use your recovery key. Enter your server, email and recovery key, and choose a new master password. Your other devices are signed out and ask for the new one.
Lost both
If you've lost both your master password and your recovery key, your vault can't be opened. This is by design: nobody holds a copy of your keys, so nobody can open it for you, MorphGate's support included. Copies on your devices and on the sync server stay encrypted.
If a device still unlocks with the system keychain, open it there, export your vault (see Export your data), and make a new recovery key while you can.
If you get an email you didn't expect
If morphgate.com tells you your password changed, your recovery key was used or replaced, or a new device signed in, and it wasn't you: sign in with your recovery key, choose a new master password, make a new recovery key, and sign unknown devices out under Sync. See Devices, signing in and signing out.