Account Recovery on a Zero-Knowledge Cloud: How It Actually Works
On Google Drive or Dropbox, forgetting your password is a minor inconvenience — click "forgot password," check your email, set a new one, done. On a zero-knowledge cloud, that flow can't exist, because the provider genuinely doesn't hold anything that could decrypt your files. Here's what replaces it.
Why the normal "forgot password" flow doesn't work here
An email-based password reset works because the provider can unilaterally invalidate your old credential and accept a new one — your data was never actually protected by that password to begin with, just gated behind a login. On LifetimeCloud, your password (via PBKDF2) derives the actual encryption key for your files. If you lose it with nothing else set up, there is no "reset" — there's only the original key, encrypted under a password nobody, including us, can guess or recover.
The recovery token: a second key to the same door
To make loss-of-password survivable without weakening the encryption itself, LifetimeCloud lets you generate a recovery token during setup. Functionally:
- A recovery token is generated in your browser — a long, random secret independent of your password.
- Your vault's encryption key is encrypted a second time, using that recovery token instead of your password, and this "encrypted key backup" is stored on the server alongside a hash of the token (never the token itself).
- You save the recovery token somewhere safe — it is shown to you exactly once.
Later, if you forget your password, you provide the recovery token instead. The server verifies the token's hash matches, then returns the encrypted key backup and your salt — your browser decrypts the backup locally using the token, recovers your real encryption key, and lets you set a new password without ever having lost access to a single file.
What the server can and can't do in this process
| Server can | Server cannot |
|---|---|
| Check whether a submitted recovery token's hash matches | Read or guess your recovery token |
| Hand back your encrypted key backup after a valid token | Decrypt that backup itself |
| Let you set a new password once you've locally recovered your key | Reset your account without a valid password or a valid recovery token |
If both your password and your recovery token are lost, there is genuinely no path back into that vault — for anyone, including LifetimeCloud. That's the trade-off zero-knowledge encryption makes, and it's the same trade-off underlying our digital legacy guide for planning what happens to your files long-term.
Setting it up — don't wait until you need it
Set up your recovery token right after creating your account, from the security section of your profile. Treat it exactly like the recovery codes from two-factor authentication: print it, store it in a password manager separate from your login password, or put it in a sealed envelope. The failure mode to avoid is the same one that locks people out of 2FA — assuming you'll set it up "later" and never doing it before you actually need it.
Real encryption, with a real way back in.
Set up a recovery token once, and a forgotten password stops being a catastrophe — without ever giving LifetimeCloud a way to read your files.
Secure your vault →