Getting Back Into Your Password Manager Can Mean Losing Everything In It

Every password manager publishes a page on what to do if you forget the master password. In all four we read, getting back into the account and getting your passwords back are separate jobs. On two of them the documented route to the first destroys the second.

At a desk that is easy to miss. In an airport it is expensive.

Proton: reset and recovery are different things

Proton is the only one of the four that separates the two jobs by name. It splits account recovery in two:

Password reset: Lets you set a new password without knowing the old one.

Data recovery: Decrypts the data on your account so you can read and interact with it again.

Then it states the consequence:

If you have a password reset method and no data recovery method, you’ll lose access to everything that was on your account before the password reset (unless you remember your old password).

You can reset your password, log back in and find the vault empty. Nothing has failed; the system did what it documents.

Proton publishes a table marking each method as password reset, data recovery, or both. A recovery email does password reset and no data recovery. A recovery phone is the same. Two entries cover both jobs:

• the 12-word recovery phrase, which Proton puts in the Recovery Kit at account creation;
• signed-in reset, which works only from a session you are already logged into.

Everything else has to be paired with something. Proton recommends enabling a recovery phrase plus one backup method for each job.

NordPass deletes the vault to let you back in

NordPass documents the same shape. Its page on resetting the account carries a note near the top:

Note: This reset will delete all of your NordPass items.

The reset works by email. You ask for a reset code, a confirmation lands in your inbox and stays valid for 48 hours, and you enter your address and a request ID. The page repeats the warning at the end:

After this process, your Vault’s items will be deleted.

The reset can be cancelled:

After 7 days, the reset becomes irreversible.

NordPass also documents a second route that most providers do not, and it is the one that matters on a trip. If you are still logged in anywhere with biometrics enabled, you do not need the destructive path. Open the app, go to settings, reset the recovery code with a face or fingerprint scan, and you have a fresh code without touching the vault. You have to be signed in somewhere already. That is the state most travellers start a trip in, and a lost phone ends it.

Bitwarden cannot help you

Bitwarden’s page opens with this:

Bitwarden operates with zero-knowledge encryption. This means that Bitwarden has no way to access, retrieve, or reset your master password.

It then lists what to try. The first item is worth knowing before you travel: check you have the right server region selected, because Bitwarden’s data regions are separate and an account exists only in the region where it was created. After that, try another device, ask for the password hint, use emergency access if a trusted contact is configured, or log in with a known device or a passkey.

The page ends:

If none of these options grant you access to your account, there is no way for Bitwarden to recover the account or its data.

The workaround it offers is manual. If you are still unlocked on another device with a PIN or biometrics, Bitwarden tells you to copy your data out of the item screens into a .csv file by hand, create a new account and import it.

1Password splits it across two secrets

1Password’s answer is the Emergency Kit, a PDF generated at signup. It holds the sign-in address, the account email, the Secret Key, a space to write the account password, and a setup QR code.

The Secret Key cannot be replaced:

We don’t have a copy of your Secret Key or any way to recover or reset it for you.

The kit does not get you back in by itself:

Your Secret Key is not a backup code. It doesn’t let you sign in if you forget your 1Password account password.

So the kit covers one of the two secrets and you are expected to know the other. Where 1Password goes further than the others is people: on a family or team account, a family organizer or administrator can recover your account for you.

Safari users get one extra catch. 1Password says you will not be able to find your Secret Key in Safari unless you sign in to your account at least every 7 days, and recommends installing the app and downloading the kit instead.

What to do before a trip

You will need this when you are least equipped for it: a phone gone in a taxi, a new country, a SIM swapped so the verification text arrives on a card in a drawer at home. We have written separately about that trap, because it catches people who did everything else right.

• Check what each method does. On Proton, open the recovery settings and read the table; the account safety review will tell you if you are short. On NordPass, confirm the recovery code is saved somewhere off the phone. On 1Password, find the Emergency Kit. On Bitwarden, there is no reset, so set up emergency access with someone you trust.
• Turn on biometric unlock on every device where you are signed in. On NordPass it turns a vault-destroying reset into a two-minute settings change. On Bitwarden it is the difference between copying entries into a spreadsheet and losing them. It helps only with the devices you still have.
• Set up the human fallback if your manager offers one. Bitwarden’s emergency access and 1Password’s family or team recovery both route around a lost password through a person, and both must be arranged before you need them. A solo account with nobody else attached has neither.
• Test it before you go. Sign out on one device while you are still at home and everything else works, then get back in using only what you would be carrying. The documentation cannot do this check for you, because it depends on which methods your account has enabled.

Limits of this check

This is a reading of four support pages, with no ranking or security review. Four providers were read because four could be verified properly, and the pages quoted are the ones each company publishes for its own users. Nothing here tests whether the encryption behind those claims is sound.

Support pages change without notice. Every quotation above was read on 14 September 2026 from the pages linked below.

Sources, all read 14 September 2026: Proton’s account recovery explainer, NordPass on resetting the account, Bitwarden on a forgotten master password, 1Password’s Emergency Kit, and 1Password on finding the Secret Key.