What is a recovery phrase, and where should you keep it?

Encrypted apps have a hard problem: if only you hold the key, what happens when you forget your PIN or lose your phone? The recovery phrase is the answer. It is a short list of words, shown to you once, that can rebuild your key from scratch.

What a recovery phrase actually is

Behind your PIN sits a long random key that does the real encrypting. Nobody could remember it, so it is written out as words instead: each word stands for a small chunk of the key. Silo uses words from a standard list of 2,048 English words. The recommended 12 words hold 128 bits of randomness, plus a short checksum that catches most typing mistakes. You can choose 6 words, which are still very hard to guess, or 2 for things that aren’t very sensitive. Fewer words are quicker to write down but easier for a powerful computer to guess, and backup needs at least 6.

Because the words are the key, written differently:

• They open your vault without your PIN. That is the point: they get you back in when the PIN is forgotten.
• They work on any phone. With a backup, they bring your whole vault back on a new phone.
• Anyone who has them can do the same. Treat them like the keys to your home.

Why nobody can reset it

With an ordinary account, a forgotten password is a nuisance: the company emails you a reset link. That works because the company can get at your data.

An end-to-end encrypted vault is built so that the company can’t. Silo has no account and never sees your key, so there is nothing to reset and nobody to ask. If you lose both your PIN and your recovery phrase, your vault stays closed for good. That is the cost of real privacy, and the reason the phrase matters so much.

Where to keep it

Good places:

• On paper, written by hand, somewhere you’d keep a passport.
• In a password manager you already trust, protected by its own strong master password.
• Both, if losing it would be a disaster.

Places to avoid:

• Your photo library. No screenshots. Photos sync, show up in search and widgets, and get swiped past when you hand your phone to someone.
• Notes apps and messages to yourself. They are often synced and easy to search.
• The same phone as the vault, unprotected. If someone has your phone and the phrase, they have everything.

If you forget your PIN

On the lock screen, choose Forgot PIN? Use recovery phrase, type your words, and set a new PIN. Your files stay exactly as they were.

If you lose the phrase, or someone sees it

As long as you can still unlock your vault, you can fix it: open Settings and create a new recovery phrase. The old one stops working at once. Do this straight away if you think someone has seen your words.

If you have lost both the phrase and the PIN, there is no way back in, for you or for anyone else.