Bloqueo da bóveda do xestor de contrasinais: perdeuse a chave secreta de 1 contrasinal, o código de recuperación de Bitwarden 2FA ou o ficheiro de clave de KeePass (extraendo sesións de bóveda locais sen conexión en caché)¶

Bloqueando o teu xestor de contrasinais (1Password, Bitwarden, KeePassXC, Proton Pass, ou LastPass) despois dun fallo na placa base do portátil, o restablecemento de fábrica do teléfono, a eliminación do perfil do navegador ou a perda accidental do seu 1Password Chave secreta de 34 caracteres (A3-XXXXXX-...), Bitwarden Código de recuperación de inicio de sesión en dous pasos ou KeePass .keyx keyfile é unha grave crise de identidade dixital. Os xestores de contrasinais modernos sen coñecemento cero cifran a túa bóveda localmente no teu dispositivo usando AES-256-GCM ou ChaCha20-Poly1305 derivado a través PBKDF2-HMAC-SHA256 ou Argon2id antes de que un só byte toque a nube. Dado que o provedor nunca posúe o seu contrasinal principal, chave secreta ou ficheiro de chave local, o servizo de atención ao cliente de AgileBits (1Password) ou Bitwarden non pode restablecer o seu contrasinal nin descifrar a súa bóveda dos seus servidores baixo ningunha circunstancia.

Non obstante, un bloqueo de inicio de sesión na nube case nunca significa que os teus contrasinais desaparecerán para sempre. Sempre que incluso un dispositivo no que se iniciou sesión previamente (un teléfono antigo, unha tableta secundaria, un portátil do traballo, un perfil de navegador do traballo, unha copia de seguranza do dispositivo iCloud ou Google Drive ou un dispositivo Windows). Volume Shadow Copy / macOS Time Machine instantánea de disco) aínda contén unha base de datos cifrada en caché local (1Password.sqlite, Bitwarden data.json, ou .kdbx réplica) e aínda coñeces o teu contrasinal principal (ou tes datos biométricos Touch ID / Face ID / Windows Hello configurado nese dispositivo secundario), podes desbloquear esa caché sen conexión local no modo avión e exportar o 100 por cento dos teus contrasinais antes de que o servidor na nube revogue o token de sesión. Para emerxencias relacionadas coas credenciais, consulte bloqueo do xestor de contrasinais e recuperación do contrasinal principal, A aplicación de autenticación TOTP perdeuse durante a actualización do teléfono ou a pantalla destrozada, e Bloqueo de MFA e recuperación do autenticador. Se o seu bloqueo implica unha crise médica ou de seguridade inmediata, chame ao número de emerxencia local (911 nos Estados Unidos e Canadá, 112 en toda a Unión Europea, 999 no Reino Unido) ou consulte o noso directorio de números de emerxencia.

Fai isto agora¶

1. ** Coloca TODOS os ordenadores, teléfonos e tabletas secundarios aos que accederon ao teu xestor de contrasinais Airplane Mode (desconecte a wifi e desenchufe Ethernet) ANTES de espertar a pantalla ou abrir a aplicación**:
2. Por que o illamento da rede é o teu primeiro movemento: se a sesión da túa conta foi desautorizada, o teu token 2FA restableceuse ou a túa subscrición caducou, no momento en que 1Password ou Bitwarden a aplicación do teu portátil secundario ou teléfono antigo conéctase a Internet, consulta a API remota (my.1password.com ou identity.bitwarden.com), recibe un HTTP 401 Unauthorized ou sinal de revogación da sesión e purga automaticamente a bóveda local sen conexión en caché (data.json / 1Password.sqlite) do disco.
3. Manter o dispositivo 100 por cento sen conexión obriga a aplicación de escritorio, a aplicación móbil ou a extensión do navegador a volver ao Modo de desbloqueo da caché sen conexión, o que che permite desbloquear a bóveda usando só o teu contrasinal principal (ou datos biométricos) sen necesidade dun código 2FA ou un novo apretón de contactos de clave secreta.
4. Nunca faga clic "Log Out", "Remove Account", "Clear Browser Data", ou "Reinstall App" nun dispositivo bloqueado: ao pechar sesión na extensión do navegador Bitwarden ou na aplicación de escritorio 1Password borra inmediatamente os datos almacenados localmente Secret Key propiedade e blob de bóveda cifrada. Deixe a aplicación bloqueada intacta e copie primeiro o cartafol de datos da aplicación subxacente nun cartafol de copia de seguranza segura.
5. Comprende cal dos tres compoñentes de bloqueo estás en falta:
6. ** Falta 1Password Chave secreta de 34 caracteres (A3-...)** (aínda que coñeces o teu contrasinal principal): a chave secreta gárdase en texto plano dentro da base de datos de configuración local de cada dispositivo onde iniciaches sesión, dentro do teu dispositivo descargado. 1Password Emergency Kit.pdf, dentro do chaveiro de Apple (iCloud Keychain) en Mac/iOS ou dentro de calquera copia de seguridade do dispositivo antigo.
7. ** Falta Bitwarden Código de autenticación/recuperación 2FA** (aínda que coñeces o teu contrasinal principal): porque a 2FA de Bitwarden só porta autenticación do servidor (non cifrado da bóveda local), calquera dispositivo que xa teña un caché. data.json O ficheiro de bóveda do disco pódese desbloquear sen conexión usando só o teu contrasinal principal ou descifrado mediante extractores de bóveda de código aberto Bitwarden (bitwarden-decrypt).
8. ** Falta KeePass / KeePassXC Ficheiro de chave (.key / .keyx)** (aínda que se coñece o seu contrasinal mestre): o ficheiro de chave é hash mediante SHA-256 na chave mestra composta; debes recuperar o ficheiro exacto de byte por byte dos sectores do disco, Volume Shadow Copies, lixo na nube ou caché de ficheiros recentes do navegador/SO.
9. Antes de abrir calquera bóveda sen conexión nun dispositivo secundario, clona o seu directorio de bóveda local nunha unidade USB externa: en Windows, macOS ou Linux, copia o directorio completo. %LocalAppData%\1Password, %AppData%\Bitwarden, ou navegador Local Extension Settings cartafol a un cartafol separado para que aínda que a aplicación falla e borre a súa caché, aínda tes unha copia prístina da base de datos SQLite/JSON cifrada.
10. Se o único dispositivo que quedan para iniciar sesión é un teléfono ou portátil con desbloqueo biométrico (Face ID, Touch ID, Windows Hello) e esqueceches o propio contrasinal mestre: non reinicias ese dispositivo (o reinicio borra o identificador da chave biométrica na RAM e obriga a solicitar o contrasinal mestre no primeiro desbloqueo). Desbloquear a aplicación mediante Face ID ou Touch ID mentres estás en modo avión, abre as credenciais de maior prioridade e consulta ou copia manualmente cada contrasinal inmediatamente.
11. Busca todos os ordenadores, anexos de correo electrónico, cartafol de Descargas e unidades na nube "Emergency Kit" ou "bitwarden_recovery_code" agora mesmo: Cando 1Password primeiro creou a túa conta, forzou a descarga do navegador dun ficheiro chamado 1Password Emergency Kit.pdf (ou gardou unha clave de acceso/chave secreta en Apple Keychain Access). Realiza unha busca en todo o sistema antes de asumir que a chave desapareceu.

Árbore de decisións: clasificación de bloqueo do xestor de contrasinais e extracción de bóvedas sen conexión¶

Siga este fluxo de traballo de recuperación forense en función do xestor de contrasinais e do factor de autenticación que perdeu:

flowchart TD
    Start["Bloqueado da bóveda do Xestor de contrasinais (1Password, Bitwarden, KeePassXC, Proton Pass)"] --> IsolateNow["PASO 1: pon todos os ordenadores portátiles, teléfonos e tabletas secundarios en MODO AVIÓN inmediatamente (antes de abrir a aplicación ou o navegador)"]

    IsolateNow --> WhichApp{"Que xestor de contrasinais e factor de credenciais faltan?"}

    WhichApp -->|"1Contrasinal: Perdeuse a chave secreta de 34 caracteres (A3-XXXXXX...), aínda se sabe o contrasinal principal"| OnePassCheck{"Aínda tes algún dispositivo iniciado (ou unha copia de seguranza de Mac/iPhone)?"}

    OnePassCheck -->|"SI: aplicación iniciada no teléfono antigo, tableta ou PC"| Extract1PKey["Abre a aplicación sen conexión -> Toca a icona da conta -> 'Configurar outro dispositivo' ou 'Ver chave secreta' para revelar a clave A3-... completa (OU Extracto de 1Password.sqlite / Chaveiro de Apple)"]

    OnePassCheck -->|"NON: só ten Time Machine, copia instantánea de Windows ou cartafol de descargas"| Search1PKit["Busca no disco e copias de seguranza '1Password Emergency Kit.pdf', '1Password.sqlite' ou 'opvault' / 'b5.sqlite'"]

    WhichApp -->|"Bitwarden: Perdín a aplicación 2FA TOTP e o código de recuperación 2FA, aínda se sabe o contrasinal principal"| BitwardenCheck{"A extensión do navegador ou o escritorio de Bitwarden aínda está conectado nalgún dispositivo (sen conexión)?"}

    BitwardenCheck -->|"SI: a bóveda almacenada en caché existe no disco"| UnlockBWOffline["Manter o dispositivo en modo avión -> Desbloquear a aplicación/extensión de Bitwarden local co contrasinal principal -> Exportar a bóveda a .json / .csv -> A continuación, restablecer a conta e volver importar"]

    BitwardenCheck -->|"NON: Extensión bloqueada ou pechada, pero 'data.json' existe no disco/copia de seguranza"| DecryptBWJson["Copia 'data.json' local desde AppData ou Browser LevelDB -> Executa o script de Python 'bitwarden-decrypt' sen conexión usando o teu contrasinal principal"]

    WhichApp -->|"KeePass / KeePassXC: ficheiro de chave perdido (.keyx/.key) ou .kdbx danado"| KeePassRescue["1. Comprobe KeePassXC '.kdbx.tmp' e o historial de versións na nube. 2. Busca o ficheiro de claves no disco a través de 'Todo' / Photorec ou a copia de sombra de volume de Windows (vssadmin)"]

    WhichApp -->|"Esquecín o contrasinal principal (aínda tes o desbloqueo biométrico activo no teléfono/laptop)"| BiometricRescue["NON REINICIAR O DISPOSITIVO: Manténgase en modo avión -> Desbloquee Vault mediante Face ID / Touch ID / Windows Hello -> Copiar contrasinais manualmente"]

Fase 1: Recuperación dun perdido 1Password Secret Key (A3-XXXXXX-...) and offline vault¶

1Password (versions 7 e 8) uses a Two-Secret Key Derivation (2SKD) architecture: your vault encryption key (MPK) is mathematically derived by combining your Master Password (via PBKDF2-HMAC-SHA256) with a randomly generated 128-bit Secret Key formatted as a 34-character string starting with A3- (for example, A3-ABCDEF-GHIJKL-MNOPQR-STUVWX-YZ1234-567890). Without that A3- Secret Key, knowing your Master Password alone is mathematically insufficient to decrypt data from 1Password's servers.

However, the Secret Key is NOT secret from your own devices: every single device that has ever logged into your 1Password account stores your full A3- Secret Key on its local storage drive so you do not have to type 34 characters every morning.

Method 1: Revealing your A3- Secret Key from any signed-in phone, tablet, or computer¶

Check every smartphone, iPad, work laptop, or desktop browser where you ever used 1Password (keep the device in Airplane Mode first): 1. On 1Password 8 for iOS / Android: - Open the 1Password app -> tap your Account / Profile icon in the top-left corner -> tap Set Up Another Device (ou Manage Accounts -> [Your Account] -> Set Up Another Device). - Tap View Account Details beneath the QR code: your full A3-... Secret Key is displayed in plain text right on the screen. Write it down on paper immediately. 2. On 1Password 8 for macOS / Windows / Linux: - Open 1Password -> click your Account name in the top-left sidebar -> select Set Up Another Device... -> click secret key and sign-in address to display the exact A3-... string. 3. Inside your 1Password Vault itself: - Every 1Password account automatically generates a built-in vault item named 1Password Account (login) inside your Personal / Private vault on day one. If you can unlock 1Password offline on any device, search your vault for 1Password Account; it contains both your Master Password and your Secret Key.

Method 2: Extracting a lost 1Password Secret Key from Apple iCloud Keychain or macOS Keychain Access¶

If you ever signed into 1Password on an iPhone, iPad, or Mac using Safari or the native app, Apple's operating system automatically offers to save your 1Password sign-in details or Account Key inside Apple Keychain / Passwords: 1. On macOS Sonoma / Sequoia (macOS 14 / 15+) or iOS 17 / 18: - Open the Passwords app (or System Settings -> Passwords) and unlock with Touch ID or Face ID. - Buscar 1password.com ou 1Password Account Key. - Inspeccione o campo de nome de usuario, contrasinal ou notas gardados: Safari e 1Password para iOS almacenan con frecuencia o A3-XXXXXX-... Secret Key inside the saved credential entry for my.1password.com. 2. En macOS Keychain Access (local items / iCloud): - Preme Cmd + Space, escriba Keychain Access e busca 1Password,agilebits ou A3-. - Fai dobre clic en calquera coincidencia application password entrada e verificación Show password.

Método 3: extraer o A3- Secret Key or cached vault from disk (1Password.sqlite & Emergency Kit.pdf)¶

Even if the 1Password desktop app will not open or your computer is unbootable (mounted as a secondary drive or restored from a Time Machine / File History / Backblaze copia de seguridade), verifique estas localizacións exactas do disco:

Fase 2: Recuperación de a Bitwarden bloqueo 2FA (data.json offline cache extraction and decryption)¶

If you lost your TOTP Authenticator app, hardware YubiKey, and your Bitwarden Two-Step Login Recovery Code, Bitwarden's cloud servers (vault.bitwarden.com) will refuse to let you log in on any new browser or phone. However, Bitwarden's cryptographic design gives you a critical rescue advantage: Bitwarden's 2FA only authenticates you to the web API; it is NOT part of the encryption key (masterKey / encKey) used to encrypt your local vault file (data.json).

Isto significa que se aínda coñeces o teu contrasinal mestre de Bitwarden e tes calquera ordenador, teléfono ou copia de seguranza que conteña unha copia almacenada en caché do local de Bitwarden. data.json ou IndexedDB / LevelDB storage from when you were logged in, you can decrypt 100 percent of your passwords offline.

Method 1: Unlocking a still-logged-in Bitwarden app or extension in Airplane Mode¶

1. Disconnect the computer or phone from the internet completely (turn off Wi-Fi, unplug Ethernet, enable Airplane Mode on mobile).
2. Open the Bitwarden Desktop App, Browser Extension (Chrome, Brave, Edge, Firefox), or Mobile App.
3. As long as the app was in the "Locked" state (asking for your Master Password or PIN/Biometrics) rather than "Logged Out" (asking for your Email Address), typing your Master Password while offline unlocks the local cached vault immediately without asking for 2FA.
4. Immediately go to Settings -> Vault options -> Export vault (ou File -> Export Vault on Desktop), select .json (unencrypted JSON, so it exports custom fields, URIs, TOTP seeds, and folder structures), enter your Master Password, and save the .json file to an encrypted USB drive or VeraCrypt container.
5. Once you have verified that your exported .json file contains all your logins in a text editor, you can safely go to vault.bitwarden.com/#/recover-delete (ou vault.bitwarden.eu/#/recover-delete), delete the 2FA-locked cloud account, create a fresh Bitwarden account with the same email, and click Tools -> Import Data -> Bitwarden (json) to restore your entire vault in 30 seconds.

Method 2: Decrypting Bitwarden's data.json or Browser LevelDB directly from disk (bitwarden-decrypt)¶

What if the Bitwarden desktop app or browser extension will not unlock in the UI, or your computer drive is mounted from a backup, or you only have the raw application data folder?

1. Locate your local Bitwarden data.json or browser extension storage on disk (make a backup copy of the folder before touching it):

1. Verify that the encrypted vault payload is still inside data.json:
2. Open your copied data.json file in a text editor (Notepad ou VS Code).
3. Search for the strings "ciphers_ e "encKey" (ou "masterKeyEncryptedUserKey" in newer Bitwarden stateVersion schemas).
4. If you see hundreds of lines of "2.iv|ciphertext|mac" strings under ciphers_<userId>, every single one of your passwords, notes, and TOTP seeds is sitting right inside that file, encrypted solely by your Master Password.
5. Decrypt data.json offline using bitwarden-decrypt (Open-Source Python Utility):
6. On any computer with Python 3 installed, download the audited open-source bitwarden-decrypt script (github.com/GurpreetKang/BitwardenDecrypt) which implements Bitwarden's exact PBKDF2-SHA256 / Argon2id + HKDF-Expand + AES-256-CBC-HMAC-SHA256 key hierarchy locally:

   pip install cryptography argon2-cffi
   python3 BitwardenDecrypt.py data.json --output recovered_vault.json
   

7. Enter your Bitwarden Master Password when prompted. The script derives your masterKey from your email and Master Password, decrypts your encKey (masterKeyEncryptedUserKey), e produce unha imaxe limpa e lexible por humanos recovered_vault.json contén cada inicio de sesión, contrasinal, semente TOTP e nota segura.

Phase 3: Recovering from a KeePass ou KeePassXC Keyfile loss or .kdbx corruption¶

Unlike cloud-hosted managers, KeePass 2.x e KeePassXC store your vault in a standalone .kdbx file (KDBX 4.x format) encrypted using a Composite Master Key. If you configured your database to require both a Master Password and a Keyfile (.key ou .keyx), KeePass hashes the exact contents of the keyfile with SHA-256 and combines that 32-byte hash with your password hash before running Argon2d/Argon2id.

1. Como atopar un extravío ou eliminado .key / .keyx Ficheiro de claves (ou imaxe/documento usado como ficheiro de claves)¶

Because losing a keyfile is equivalent to losing a 256-bit cryptographic key, you cannot brute-force a missing random keyfile; you must locate a byte-identical copy of the file: 1. Inspeccionar KeePassXC.ini / KeePass.config.xml to see the exact last-used filename and path of the keyfile: - Moitas veces os usuarios esquecen que ficheiro no seu ordenador seleccionaron como ficheiro de chave (moitos usuarios seleccionan un ficheiro .jpg photo, .pdf document, or obscurely named file on a USB drive). - Open your local configuration file in a text editor: - KeePassXC (Windows): %AppData%\KeePassXC\keepassxc.ini (ou %LocalAppData%\KeePassXC\keepassxc.ini) -> look under [LastDatabases] ou LastKeyFiles. - KeePassXC (macOS / Linux): /Users/<Username>/Library/Application Support/KeePassXC/keepassxc.ini ou /home/<Username>/.config/keepassxc/keepassxc.ini. - KeePass 2.x (Windows): %AppData%\KeePass\KeePass.config.xml -> search for <KeyFilePath>. - Knowing the exact filename and folder path (E:\Keys\my_secret_pic.jpg) tells you which USB stick, SD card, or cloud folder to search. 2. Carve a deleted .keyx XML Keyfile from unallocated disk space in 60 seconds: - Standard KeePass / KeePassXC generated keyfiles (.keyx ou .key formato XML) son pequenos (< 1 KB ficheiros) que comezan cunha cabeceira XML distintiva:

<?xml version="1.0" encoding="utf-8"?>
<KeyFile>
    <Meta>
        <Version>1.00</Version>

2. Fixing a corrupted .kdbx database (Invalid signature ou HMACHashMismatch after power loss or cloud sync)¶

If your .kdbx lanzamentos de ficheiros Not a KeePass database ou Corrupted database / HMAC mismatch after a computer crash or Google Drive / OneDrive sync conflict: 1. Busca oculto .kdbx.tmp ou .kdbx.bak atomic-write sibling files: - By default, KeePassXC uses Safe Save (Atomic Write): it writes changes to a temporary file in the same folder first, then renames it over the original .kdbx. Busca calquera no mesmo directorio (con ficheiros ocultos activados). .tmp, .bak, ou copia en conflito (Passwords (Conflicted copy).kdbx). 2. Restaurar a versión de onte desde o historial de versións na nube ou a copia instantánea de Windows: - If your .kdbx está dentro de Dropbox, Google Drive, OneDrive ou iCloud Drive, inicie sesión no portal web da nube no seu navegador, prema co botón dereito .kdbx ficheiro e seleccione Version History para descargar a revisión limpa anterior de antes da corrupción. 3. Executa KeePass 2.x integrado Repair ModeImportación: - Abre KeePass 2.x oficial en Windows -> crea unha nova base de datos en branco -> fai clic File -> Import... -> seleccionar KeePass KDBX (2.x) (Repair Mode) -> apunte ao teu corrupto .kdbx e introduza o seu contrasinal principal. O modo de reparación ignora os pés de páxina HMAC de fluxos rotos e salva todos os bloques de entrada lexibles ata a compensación de bytes corrompida.

Fase 4: extracción de bóvedas en caché de copias de seguridade de iOS, Android e macOS (iMazing, Time Machine, e DPAPI volcados de memoria)¶

Que pasa se o teu teléfono principal se perdeu, roubáronche ou se restableceu a configuración de fábrica e o teu portátil xa se eliminou ou pechou sesión, deixandoche sen sesións activas en directo? Aínda podes extraer a bóveda do xestor de contrasinais sen conexión dunha copia de seguranza local do iPhone, unha instantánea de macOS Time Machine ou un ficheiro de volcado de hibernación/fallo de Windows.

1. Extracción 1Password ou Bitwarden Bóvedas SQLite/JSON desde unha copia de seguridade de iPhone ou iPad (iMazing / idevicebackup2)¶

Sempre que fas unha copia de seguranza dun iPhone ou iPad nun ordenador Mac ou Windows (especialmente unha Copia de seguranza local cifrada no Finder ou iTunes), o arquivo de copia de seguranza captura os contedores de probas de proba da aplicación. 1Password e Bitwarden: 1. Non restaure primeiro a copia de seguranza nun teléfono conectado a Internet en directo: se restauras a copia de seguranza nun teléfono que se conecta á wifi durante o Asistente de configuración, a aplicación restaurada fará un ping inmediatamente ao servidor na nube e borrará o seu token caducado. 2. Utiliza iMazing ou iBackup Viewer nun ordenador sen conexión para explorar o sistema de ficheiros de copia de seguridade en bruto: - Abre a túa copia de seguranza local do iPhone iMazing (File System -> Apps -> 1Password ou Bitwarden). - Para 1Password: Ir a AppDomainGroup-group.com.agilebits.onepassword-ios/Library/Application Support/1Password/Data/ e extraer 1Password.sqlite (ou B5.sqlite). Dentro do accounts a táboa dese ficheiro SQLite sitúase no teu texto plano A3-XXXXXX-... Secret Key. - Para Bitwarden: Ir a AppDomainGroup-group.com.8bit.bitwarden/Library/Preferences/ e extraer group.com.8bit.bitwarden.plist. Converte o binario .plist a XML (plutil -convert xml1 group.com.8bit.bitwarden.plist) e ábreo nun editor de texto: contén exactamente o mesmo ciphers_<userId> e masterKeyEncryptedUserKey Estruturas JSON utilizadas por BitwardenDecrypt.py, o que che permite descifrar cada contrasinal sen conexión usando o teu contrasinal mestre.

2. Extracción Proton Pass, Dashlane, e LastPass caché do navegador fóra de liña¶

Se o teu bloqueo implica Proton Pass, Dashlane, ou LastPass: - Proton Pass Modo sen conexión e caché de extensión do navegador: Proton Pass almacena en caché unha instantánea local cifrada dentro de Chromium IndexedDB (chrome-extension_<id>_0.indexeddb.leveldb). Se mantés o teu portátil en Modo avión, abres o navegador e desbloqueas Proton Pass co teu contrasinal ou PIN, podes acceder á túa bóveda sen conexión e exportar ou ver as túas credenciais antes de volver conectarte á rede. - LastPass Caché local sen conexión (lpall.slp / acct.slp): en Windows (%LocalAppData%\LastPass ou %AppData%\LocalLow\LastPass) e macOS (/Users/<Username>/Library/Application Support/LastPass), LastPass stores an AES-256 encrypted local XML/SQLite cache file named after your email hash. Disconnecting Wi-Fi and signing into the LastPass browser extension with your Master Password bypasses broken multifactor authenticators and opens the local offline vault directly.

3. Dumping a still-unlocked vault from Windows RAM (Task Manager -> Create dump file) before a forced lock¶

If you realize you have forgotten your Master Password (or deleted your KeePass keyfile while the database is currently open and unlocked on your screen right now), DO NOT lock the database or close the window. 1. Even when KeePassXC, Bitwarden, ou 1Password requires you to re-type your Master Password to click the Export Vault button, the decrypted vault entries or the derived 256-bit MasterKey are currently sitting in process memory (RAM) while the vault window is unlocked. 2. First, click through your highest-priority logins on screen (email, banking, cloud accounts, domain registrar) and copy them into an encrypted text file or photograph them. 3. For KeePass / KeePassXC: While the database is still unlocked, if you forgot the Master Password or deleted the keyfile, check whether File -> Export -> CSV works without prompting for the Master Password (in several versions of KeePassXC, exporting an already-unlocked database to CSV or HTML does not require re-entering the composite key).

Preguntas frecuentes¶

Can 1Password or Bitwarden customer support unlock my vault if I send them my government passport and notarized ID?¶

No, it is mathematically impossible. Both 1Password and Bitwarden use end-to-end zero-knowledge client-side encryption. O teu contrasinal principal (e os 34 caracteres de 1Password A3- Secret Key) never leave your device and are never transmitted to their servers. Even if a court subpoenaed AgileBits or Bitwarden, or you presented a notarized passport in person at their headquarters, their servers only hold an encrypted ciphertext blob (AES-256) that cannot be decrypted without the keys stored on your own devices.

Why does disconnecting Wi-Fi (Airplane Mode) let me unlock Bitwarden without my lost 2FA code?¶

In Bitwarden's security architecture, Two-Step Login (2FA) is an authentication check enforced by the Bitwarden cloud server when downloading your encrypted vault blob over the internet; it is non used as part of the cryptographic key that encrypts the vault itself. Once a device has logged in once, Bitwarden caches that encrypted vault locally inside data.json (or browser LevelDB) protected by your Master Password. When you keep the computer or phone in Airplane Mode, the app unlocks the local cached copy using only your Master Password and lets you export all your passwords to a .json ou .csv file.

What if I forgot my Master Password, I have no Emergency Kit, and my only open session is on my iPhone with Face ID?¶

If your iPhone or iPad still unlocks your password manager via Face ID or Touch ID, treat that phone like bomb-disposal hardware: keep it plugged into a charger, put it in Airplane Mode, and DO NOT let the battery die or reboot the phone. If the phone reboots, or if Face ID fails 3 to 5 times in a row, the app flushes the biometric decryption key from the Secure Enclave session and forces you to type your forgotten Master Password. Note that exporting a vault via Settings -> Export usually requires typing the Master Password even when unlocked via Face ID; therefore, do not try to use the bulk Export menu. Instead, unlock with Face ID and manually open each critical account entry one by one, tap the eye icon to reveal the password, and photograph or write down each password on paper.

How do I prevent a password manager lockout from ever happening again once I recover my vault?¶

Immediately after recovering your vault, implement the 3-Layer Physical + Offline Backup Rule: (1) Print two physical paper copies of your 1Password Emergency Kit (or your Bitwarden Master Password + 2FA Recovery Code) and store one in a fireproof home safe and one in a bank safe deposit box or with a trusted family member; (2) Export an encrypted backup of your vault (.kdbx or password-protected Bitwarden .json) onto two offline USB flash drives every 90 days; and (3) If you use 1Password Families ou Bitwarden Families / Enterprise, assign a trusted partner or second admin account to the **Account Recovery** role, which holds an escrow key capable of resetting a family member's forgotten Master Password or lost Secret Key.

Guías relacionadas¶

• Password manager lockout, master password loss, and vault recovery
• Authenticator app TOTP lost during phone upgrade or screen shatter
• Bloqueo de MFA e recuperación do autenticador
• Passkey and WebAuthn device loss: synced vs. hardware-bound passkeys
• VeraCrypt, BitLocker, or Cryptomator corrupted volume header recovery
• Números de emerxencia por país

Fontes e orientacións oficiais¶

• 1Password Official Security White Paper & Support Documentation (support.apple.com / support.1password.com/secret-key-security/ & support.1password.com/find-secret-key/): Two-Secret Key Derivation (2SKD), A3- Secret Key Storage on Authorized Devices, and Emergency Kit Recovery Procedures.
• Bitwarden Official Security & Cryptographic White Paper (bitwarden.com/help/bitwarden-security-white-paper/ & bitwarden.com/help/storage-locations/): Master Password Key Derivation (PBKDF2-SHA256 / Argon2id), Local data.json Offline Storage Locations, and Two-Step Login Recovery.
• KeePass / KeePassXC Official Documentation (keepass.info/help/base/keys.html & keepass.info/help/base/repair.html): Composite Master Key Architecture, .keyx XML Keyfile Specification, and KDBX 4.x Repair Mode Import.
• GurpreetKang Open-Source Forensic Tool (github.com/GurpreetKang/BitwardenDecrypt): Offline Decryption of Cached Bitwarden data.json Vault Files Using Known Master Passwords.