Forgot Your Master Password? Bitwarden, 1Password, KeePassXC

Bitwarden cannot reset a forgotten master password: its help center says it has “no way to access, retrieve, or reset” it. Your routes back in are the emailed password hint, an app still unlocked by PIN or biometrics, Log in with device, an encryption-enabled passkey, Emergency Access, or Enterprise account recovery. Otherwise, delete the account and start again.

1Password works the same way at the vendor end, but a recovery code or a family organizer can get you back in with a new Secret Key. KeePass and KeePassXC have no recovery service at all. Almost every option below only exists if you set it up before the lockout.

So the most-ignored advice is still the most important: do not lose your master password. The provider cannot read your vault, which is exactly why it cannot reset your password the way your bank can.

If you don’t yet have a vault: start with the Bitwarden setup guide and come back once your account exists.

Recovery options compared: Bitwarden, 1Password, KeePassXC

Why your provider can’t just reset your master password

All three managers use your master password (often combined with extra material like 1Password’s Secret Key) as part of the key that decrypts the vault locally on your device. The server never sees the plaintext password or the decryption key. This is the point of a “zero-knowledge” architecture: a breach of the provider’s servers does not breach your vault.

The tradeoff: if you forget the only material that can unlock your vault, no support ticket can bring it back. Bitwarden’s help center is blunt about this in its forgotten master password documentation, and 1Password’s recovery flow exists only because you set up a recovery code or family-account recovery in advance.

So “recovery” means one of three things:

1. A pre-issued recovery code or kit saved somewhere safe.
2. A trusted person on your plan who can initiate recovery for you.
3. Another credential or device that is already trusted: an app unlocked with PIN or biometrics, a registered device, or a passkey that can decrypt the vault.

There is no fourth option.

Forgot your Bitwarden master password? Try these in order

Start with the cheap checks: the right server region, any app still unlocked by PIN or biometrics, and your emailed hint. Then try Log in with device or a PRF passkey, ask your emergency contact or Enterprise admin, and delete the account only when nothing else works, because deletion destroys every item you own.

1. Check the server region. Bitwarden’s US and EU regions are separate, and your account exists only in the one where you created it. A correct password fails at vault.bitwarden.com if the account lives at vault.bitwarden.eu.
2. Try an app that still unlocks with PIN or biometrics. Export asks you to confirm with your master password or, on web and desktop, an email verification code. If that blocks you, the documented fallback is manual: copy each item from its View screen into a .csv file and import it into a new account.
3. Request your hint. At vault.bitwarden.com/#/hint (or the .eu equivalent), Bitwarden emails the hint, if you set one.
4. Log in with device. If this browser is already registered as a known device, choose Log in with device and approve the request from another logged-in Bitwarden app.
5. Log in with a passkey. Only an encryption-enabled (PRF) passkey registered on the account works; see how passkeys work.
6. Ask your emergency contact to request takeover (below).
7. Ask your Enterprise administrator for account recovery (below).
8. Delete and start over. This removes all individually owned items and attachments, and Bitwarden cannot restore a deleted account. If the old account had Premium, Bitwarden support will apply the subscription to the new one.

Emergency Access: the only personal-plan reset

Emergency Access is the one way to reset a Bitwarden master password on a personal account, and it must be configured in advance. It is available to Premium users and members of paid organizations (Families, Teams, Enterprise). On Bitwarden’s pricing page, checked September 2026, Premium is $19.80 a year and Families is $47.88 a year for up to six users; Free does not include it. The contact can be on a free account on the same Bitwarden server. The Bitwarden review covers what else Premium adds.

To set it up, per Bitwarden’s contact guide:

1. In the web app, go to Settings → Emergency access.
2. Select Add emergency contact, enter the contact’s email, choose View or Takeover, set a Wait time (minimum one day), and Save. The invitation is valid for five days.
3. Your contact opens the email and selects Become emergency contact.
4. Back on the same page, open the menu next to the contact marked Needs Confirmation, choose Confirm, and check the fingerprint phrase with them in person.

When you are locked out, the contact selects Request Access next to your account on their own Emergency access page. You can approve or reject it; if you cannot sign in before the wait time ends, the request is approved automatically.

View gives read access to your individual vault, including passwords and attachments, so you copy everything into a new account. Takeover has the contact create a new master password that replaces yours and removes any two-step login methods; they hand it to you, and you sign in and change it.

Account recovery: Enterprise only

Bitwarden’s admin-led master password reset is limited to Enterprise organizations; it does not exist on Free, Premium, Families or Teams. When a member enrolls, their encryption key is encrypted with the organization’s public key and stored as an “Account Recovery Key”. An owner, admin, or custom role with the Manage account recovery permission can then reset the member’s master password, two-step login, or both. The member gets an email link and sets new credentials.

Limits: only owners can reset another owner, recovery does not bypass SSO, and it cannot bring back a deleted account.

Is there a Bitwarden recovery key?

Not for personal accounts. The “recovery code” in Bitwarden settings is the two-step login recovery code: it disconnects all 2FA methods if you lose your authenticator, but you still type your master password alongside it. The “Account Recovery Key” is the Enterprise organization’s copy described above.

Get the 2FA code while you can still sign in: Settings → Security → Two-step login → View recovery code, then confirm with your master password. A new code is generated each time one is used, so save the replacement. The YubiKey 2FA setup guide covers keeping it outside the vault.

1Password: the Recovery Code, the Secret Key, and family recovery

1Password’s recovery model is the most layered of the three because the master password is only part of what decrypts your vault. The other part is the Secret Key: 34 letters and numbers with 128 bits of entropy, created on your device and stored only on devices you have signed in on and in your Emergency Kit. 1Password has no record of it and cannot recover it.

The Emergency Kit and Secret Key

On signup, 1Password generates an Emergency Kit PDF containing your sign-in address, email, Secret Key, and a blank field for your account password. Print it and store it physically: a safe, a safety deposit box, or a sealed envelope with a trusted person. If you wrote your password in that field, check the Kit first; it is the fastest recovery there is.

If an app still unlocks with biometrics

Touch ID, Face ID, Windows Hello or Android fingerprint unlock can still open the app after you forget the password, but 1Password warns that this ability will eventually expire. Use the window. Search your Personal vault for a Login item named “1Password Account”, which may hold the password. If it does not, export your data, sign up for a new account, import the export, and remove the old account.

Option 1: Recovery code (individual and family accounts)

A recovery code lets you back in after you forget the account password, lose the Secret Key, or both. Recovery codes are limited to individual and family accounts; team and business accounts cannot create them. You cannot create one after you have lost access.

To set it up in the apps:

1. Open and unlock 1Password.
2. Select your account at the top of the sidebar, then Manage Accounts.
3. Select your account, then Sign-in & Recovery.
4. Choose Set up recovery code and save the code outside the vault.

On 1Password.com, select your name in the top right, then Manage Account → Set up recovery code.

To use it: on the sign-in page select Having trouble signing in?, then Use Recovery Code, enter the code, verify your email with the code 1Password sends, and create a new account password. You also receive a new Secret Key, so download the new Emergency Kit. You need access to the email address on the account, and the recovery code stays valid for future use.

Option 2: Family recovery

On a 1Password Families or business plan, a family organizer, team administrator or owner can recover another member’s account: People → the member’s name → Begin Recovery, then Complete Recovery once the member has set new credentials. The member keeps their data, gets a new Secret Key, and must sign in again on every device. Family recovery is the most user-friendly option and one of the main reasons the Families plan is worth the price for non-technical households; we compare it against the alternatives in the best password manager for families guide.

Two catches. A family organizer cannot recover their own account this way, so 1Password tells organizers to create a recovery code for themselves. And it recommends at least two people who can recover accounts, so the organizer is never the single point of failure.

1Password support itself cannot recover your account. They have neither your account password nor your Secret Key. With no recovery code, no family member to recover you, and no app that still unlocks, the vault is gone.

Can you recover a KeePass or KeePassXC master password?

No. KeePass’s documentation states that if you “forget/lose any of the master key components (or forget the composition), all data stored in the database is lost”, and that there is “no backdoor and no universal key”. What remains is an older backup that opens with a password you remember, or guessing variations of one you mostly recall.

KeePassXC has no server, no provider and no recovery service; your vault is a .kdbx file. The official KeePass security page describes AES-256 or ChaCha20 encryption keyed from your master password (plus optional key file and/or hardware key). Its key derivation (AES-KDF or Argon2) adds a work factor to every attempt to slow guessing, so trying variations only helps when the forgotten part is small.

What you can design is redundancy. KeePassXC supports composite master keys: any combination of master password, key file (a random blob KeePassXC generates that must be present), and a hardware key (YubiKey HMAC-SHA1 on a slot). Each extra component is one more thing you can lose, so each needs its own backup.

Practical KeePassXC recovery setup

1. Backups, plural. Keep encrypted copies of your .kdbx in at least two locations: a cloud sync (Dropbox, Nextcloud, Syncthing) and a removable drive in a different physical location. The file is already encrypted, so storage doesn’t have to be high-trust.
2. A hardware-key second factor. Configure a YubiKey HMAC-SHA1 slot and add it to the database (Database → Database Security → Add additional protection → YubiKey). Keep a backup YubiKey programmed identically; the KeePassXC documentation advises keeping a copy of the HMAC secret itself in a secure location.
3. A key file backup. If you use a key file, copy it to independent storage. KeePass 2.x can also print a paper backup of an XML key file from File → Print.
4. A sealed master password copy. Write it on paper, seal it in an envelope, store it in a safe or with a trusted person, and check on it yearly. This is the closest KeePassXC has to “emergency access”.

For a deeper walk-through of KeePassXC’s threat model, see the KeePassXC review.

Set this up before you need it

Go configure recovery today, before you forget anything:

• Bitwarden: add an Emergency Access contact and confirm them, save the two-step login recovery code outside the vault, and set a hint that means something only to you.
• 1Password: generate a recovery code and print the Emergency Kit. Family organizers: make sure a second person can recover accounts.
• KeePassXC: confirm two backups of the .kdbx, a backup of any key file or YubiKey secret, and a sealed paper copy of the master password.

While you’re tightening the basics, re-read the password security fundamentals. Recovery is one layer, but a strong unique master password plus phishing-resistant 2FA is the layer you want to never have to test.

The worst time to learn how your password manager’s recovery works is the moment you realise you can’t get in.

FAQ

Can Bitwarden support reset my master password?

No. Bitwarden’s zero-knowledge design means support never holds your master password or the key it derives, so there is nothing for them to reset. What support can do, after you delete a locked account and open a new one, is apply your existing Premium subscription to the new account so you do not pay twice.

How long does Bitwarden emergency access take?

As long as the wait time you chose when inviting the contact, with a minimum of one day. You can approve a request immediately if you can still sign in; if you cannot, Bitwarden approves it automatically once the wait time runs out. The invitation itself expires after five days if the contact does not accept it.

Can 1Password recover my account without a recovery code?

Only if someone else on your plan can. A family organizer, team administrator or owner can start recovery from the People page, and you choose a new password and get a new Secret Key. 1Password staff cannot do it. On an individual account with no recovery code and no app that still unlocks, the data is lost.

Is there a KeePass master password recovery tool?

There is no official one: KeePass and KeePassXC have no backdoor or universal key. Third-party password-guessing tools can test candidates against your own database file, but key derivation makes each guess slow on purpose, so this only succeeds when you remember most of the password and need to try a small set of variations.