Locked out of your password manager

You remember the websites and you cannot open the vault that stores their passwords. Bitwarden and 1Password both say they cannot read or reset that master password. The way back is a device that is still unlocked, a kit or a hint you saved, a recovery code, or another person you already trusted with recovery. If none of those exist, the vault contents are gone and you start a new one.

Find every phone, browser, and laptop where the app might still be unlocked before you delete anything. The business version of this, including a second administrator and an offline kit, is Password manager locked out. If the lock is the Google or Apple account around the vault, use Locked out of your Google or Apple account.

The steps below are the vendors’ own. A workplace vault can add an administrator path that a personal vault does not have.

1Password

The account password unlocks the apps and 1Password.com. 1Password’s forgotten-password article says that password is never sent over the internet, never written to a local log, and never known to 1Password. That is why support cannot type a new one for you.

Look for the Emergency Kit first. 1Password’s Emergency Kit article says it is the PDF they asked you to save when you created the account. Check Downloads. It holds the sign-in address, the email on the account, the Secret Key, a line where you were meant to write the account password, and a setup QR code. If you turned on two-factor authentication, they also tell you to write the 16-character secret next to that QR code on the printed copy.

You can save another kit only while you are signed in. On 1Password.com, select your name, then Manage Account, then Save Emergency Kit.

If you think you know the password and the app rejects it, 1Password’s checks are ordinary and worth doing once.

• Match the capitals.
• Type it in a text editor, then paste it in.
• Try the previous account password if you have changed it.
• Try the password from another 1Password account, if you have more than one.
• Try it with and without spaces, and with and without accented characters.
• Check the keyboard layout if you type in more than one language.

A fingerprint or a face can still open the app after the password is forgotten. 1Password says that unlock expires. Use it now.

• On a Mac, approve the “1Password is trying to unlock” prompt with Touch ID or a double-click on an Apple Watch. If you do not see it, use the Touch ID or Apple Watch button on the lock screen.
• On an iPhone or iPad, use Touch ID or Face ID. The button beside the password field brings the prompt back.
• On Windows, use Windows Hello. If the password field is blank, select it or press Enter. If the face or finger fails, choose More choices and use the device PIN.
• On Android, use the fingerprint or the face scan, or the button beside the password field.
• On Linux, use your Linux user password, a fingerprint, or a security key. If you are not prompted, select the empty password field or press Enter.

While it is open, look in the Personal vault for a Login item named “1Password Account”. 1Password says it may contain the password. Export the data before the biometric unlock expires. You can create a new account and import that export.

If an old password still unlocks the app on one device, and 1Password.com rejects it, the items are local and they will not sync. 1Password’s copy path is:

1. Sign up at start.1password.com/sign-up with a different email address.
2. Download the new Emergency Kit and write the new account password on it.
3. Add the new account to the app.
4. Copy the items into the new account.
5. Remove the old account from the app.

Two more doors, if you set them up earlier. A recovery code on 1Password.com lets you pick a new password after you verify it is you, and you also get a new Secret Key. A family organizer or a team administrator can recover the account, with the same result: a new password and a new Secret Key.

If the password works on every device except one, 1Password asks you to send a diagnostics report from the device that fails. If you have tried the kit, the biometrics, the recovery code, and the family or team recovery, their last line is to contact 1Password Support and start over.

Bitwarden

Bitwarden’s forgotten-master-password page says the vault uses zero-knowledge encryption. Bitwarden has no way to access, retrieve, or reset the master password.

Work through their list in order.

1. Check the server. A Bitwarden account lives in the region where it was created. The US and EU vaults are separate. Selecting the wrong server looks like a bad password.
2. Try another Bitwarden app, such as the phone app or the browser extension.
3. If one device still unlocks with a PIN or biometrics, unlock it, copy the items from the view screen into a CSV file, create a new Bitwarden account, and import that file.
4. Request the hint at vault.bitwarden.com/#/hint, or vault.bitwarden.eu/#/hint for an EU account. If you saved a hint, Bitwarden emails it. If you did not, the email says so.
5. If you turned on emergency access, ask that person to request it. In the web app they open Settings, then Emergency access, then the menu beside your account, then Request Access. You can approve or deny the request if you can still sign in. If you cannot, it is approved when the wait you configured runs out. View access shows the items. Takeover lets them set a new master password and sign in with your email.
6. If this is an organization account and an administrator enrolled you in account recovery, ask them to reset the master password, the two-step login, or both. Bitwarden’s account-recovery article says you then get an email link to set a new master password or a new two-step method. That reset does not skip single sign-on, and it does not skip two-factor authentication that your identity provider asks for. A deleted account is not restored.
7. If this browser was set up for Log in with device, choose that in the web app and approve it from another Bitwarden app.
8. If you registered an encryption-enabled login passkey, Bitwarden calls it a PRF passkey, you can sign in with that.

If none of those open the vault, Bitwarden says to check every device and browser once more. After that they cannot recover the account or the items. You delete the account and create a new one. Deleting removes individually owned items and attachments. A premium subscription can be moved to the new account if you contact Bitwarden and ask.

Apple Passwords and iCloud Keychain

The Passwords app does not have a separate master password. Apple’s iCloud Keychain article says the passwords, passkeys, card details, and Wi-Fi passwords sync to devices you approve. The data is end-to-end encrypted with a key from the device plus the device passcode, which only you know.

To turn sync on, on an iPhone, iPad, or Apple Vision Pro:

1. Open Settings, tap your name, then tap iCloud.
2. Under Saved to iCloud, tap Passwords. On iOS 17 or earlier, tap Passwords and Keychain.
3. Tap Sync this device. You may need the passcode or the Apple Account password.

On a Mac, open System Settings from the Apple menu, click your name, click iCloud, click Passwords, then click Sync this Mac. On macOS Sonoma or earlier the label is Passwords & Keychain.

If you chose Approve Later when you signed in, Apple asks you to approve with an old passcode or from another device. If you cannot approve, their article says to reset your end-to-end encrypted data when the screen prompts you. Follow that prompt. Do not guess at a second screen they have not shown you.

Signing out of iCloud while Keychain is on asks you to keep or delete the Keychain on that device. Keep leaves a local copy that stops updating. Delete removes it from that device. Apple says an encrypted copy stays on iCloud, and turning Keychain sync back on brings the passwords and passkeys down again, once you can sign in.

If the problem is the Apple Account password, a device you are already signed in on can change it without the long recovery. Apple’s forgotten-password article says to look for Forgot password? and follow the screen. If you will have a trusted device or a trusted phone number soon, wait and use those. They get you in faster. A trusted device is an iPhone, iPad, Apple Watch, Apple Vision Pro, or Mac that is already signed in with two-factor authentication.

Without a trusted device, Apple may ask for a trusted phone number, a 6-digit code from a recovery contact, the Apple Account email, or the CVV of a card on the account. If the card check fails even when the CVV is right, choose Don’t have access to this card. A recovery key or a Security Key changes this path. Apple’s article for those is the one to follow, not this page.

The account-recovery playbook for that Apple sign-in is Locked out of your Google or Apple account.

Google Password Manager

Saved passwords and passkeys in Chrome and on Android live in the Google Account when you are signed in. Google’s Password Manager article says to sign in to Chrome and open Password Manager. If you cannot sign in to the Google Account, the vault is behind that lock. Use Locked out of Gmail on a new phone.

Passkeys add a second lock. Google’s PIN article says the first passkey you create on a computer, an iPhone, or an iPad creates a Google Password Manager PIN. Google uses that PIN so they cannot read the encrypted passkeys. On Android, Password Manager uses the screen lock, the PIN, pattern, or password, and there is no button to change a Google Password Manager PIN.

To change or reset the PIN on a computer:

1. Open Chrome.
2. Select More, then Passwords and autofill, then Google Password Manager. You can also open chrome://password-manager/settings.
3. Select Settings, then Change Google Password Manager PIN.

On an iPhone or iPad, open Chrome, tap More, then Password Manager, then Settings, then Change Google Password Manager PIN.

If that button is missing, Google lists four reasons. The first passkey was created on an Android device. This device has never used those passkeys. This device used passkeys from a different Google Account. You removed passkey access on this device.

If you have tried every device and still cannot recover the PIN, Google’s iPhone and iPad article says you can reset your passkeys. That deletes them. You create new passkeys on each site, and the first new one lets you set a PIN again. Passwords saved in the Google Account are a separate store from that PIN.

KeePass

KeePass is a file on your disk. KeePass’s master-key page says the database is encrypted with a master key. That key can be a master password, a key file, a Windows user account, or a combination. Opening the file requires every part. If you forget or lose any part, or you forget which parts you used, the data in the database is lost. KeePass says there is no backdoor and no universal key.

A key file that you edited, or that arrived corrupted, will not open the database either. KeePass tells you to keep a backup of that file somewhere other than next to the database. If both files are together, the key file is not a second factor.

The Windows user account option is easy to regret. KeePass says that if that Windows account is deleted, you cannot open the database. A broken disk is not fixed by creating a new Windows user with the same name and password. Changing the Windows password yourself still allows the database to open. An administrator resetting the Windows password usually does not.

Firefox primary password

If Firefox asked for a primary password before it would fill logins, that password encrypts the saved usernames and passwords on that profile. Mozilla’s reset article says a forgotten primary password has to be reset, and the reset removes all of those saved usernames and passwords.

1. In the address bar, open chrome://pippki/content/resetpassword.xhtml.
2. Press Enter.
3. On the Reset Primary Password page, click Reset.

Do that only when you accept that the saved logins on this profile go away. Mozilla does not offer a way to reveal the old primary password.

After a vault opens again

Write the master password onto the Emergency Kit, or into the Bitwarden hint, while you still have it in front of you. Print the kit or export an encrypted copy and keep it outside the vault. A recovery code that lives only inside the locked vault cannot unlock it.

On a shared or company vault, a second person should be able to open it without you. That is the drill in Password manager locked out. If the email account that receives the vault’s reset messages was also taken, clean that inbox first with Personal email account hacked.

Related playbooks

• Password manager locked out. The vault containing business passwords, recovery codes, and secure notes is unavailable or cannot be unlocked.
• Locked out of your Google or Apple account. Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.