Recovering a vault without a back door: guardians and recovery phrases
Essence holds no key to your vault, so there is no reset for anyone to abuse. Since our September release, a 24-word recovery phrase that never leaves your device reopens it.
You lose your phone on a train, and the passkey that opens your vault goes with it. A week later you find you have forgotten your password as well. On most services, this is the moment for a reset email and a call to support. On Essence, you type 24 words into a new device and your vault opens. Nobody at Essence takes part, and nobody at Essence could.
Why there is no reset button
Your vault is encrypted on your device. Our servers receive the encrypted content and the metadata needed to run the service, and Essence holds no key that can decrypt what you store. There is none in a store of our own, none in escrow and none behind a support process.
That rules out the usual kind of recovery. If a support agent could reset your access, so could anyone who persuaded, compromised or compelled that agent. A reset that works for you works for them as well. So a forgotten password never triggers a reset on our side, and there is no reset email for anyone to intercept or fake.
The choice has a cost, and it is better said plainly. If you have no recovery method, nobody can get your data back. Recovery has to be something you set up in advance and keep yourself.
Your 24 words
The recovery phrase is that something. It is 24 words, generated for you and written down by you. Since our September release, it reopens your vault on a new device.
The phrase never leaves your device. Your device turns the 24 words into a proof, and our servers keep only a protected copy of that proof. That copy cannot open your vault.
The recovery screen gives nothing away either. An unknown email address, an account with no phrase set up and a wrong phrase all get the same answer. A wrong phrase also counts towards the same lockout as a wrong password. Nobody can use the screen to find out who has an account, or to guess their way past the lockout.
New accounts are given a checklist for getting started, and saving a recovery method is one of its items. You can acknowledge it and carry on without one, but the right time to write down your 24 words is at the start, while your devices are still in your hands.
Guardians: recovery shared with people you trust
The second route back in runs through people you trust.
The design works like this. You nominate guardians, and your vault key is split into shares that they hold. No single guardian can open anything. A set number of them together are designed to help you rebuild the key: 3 of 5 for personal use, 5 of 7 for higher-security and organisational settings, and 7 of 10 for enterprise and regulated ones. The rebuilding takes place on your new device. Our servers coordinate and record that guardians have responded, but never hold enough shares, or any share in usable form, to rebuild the key themselves.
The design includes one optional safety net: a recovery-service share within the platform's reach, to lower the risk of someone being locked out for good. It is one share, fewer than any scheme needs, so on its own it rebuilds nothing. Our security documentation recommends that organisations with a strict insider-threat model do not permit it.
What this means for you
For a person, it means one small task: write down 24 words and keep them offline, with the care you would give a spare house key, because they are a second way in. For an organisation choosing a platform for its people, the recovery design and the security design are the same design. Ask us whether we can get into a person's vault and the answer is no, with the reasons set out in our security documentation. If that is the answer you need, we would be glad to walk you through how it works.
Published 4 September 2026