Forgot your master password? What you can and cannot do

In most password managers, a forgotten master password cannot be recovered. It can only be worked around using a recovery mechanism you set up beforehand. That is not a support failure. It is the direct consequence of the encryption being real: if the provider could recover your master password, they could also read your vault, and so could anyone who compromised them.

Here is what actually exists, by product, and what to do when nothing applies.

First: what a recovery option is not

There is no “email me a reset link” for a zero-knowledge vault. Every genuine recovery path is one of these four:

1. A recovery code or key generated at signup, which you were told to print.
2. An account you are still signed in on (a phone, a browser profile) where the vault is currently unlocked.
3. A biometric or PIN unlock already enabled on a device, which uses a locally stored key.
4. An administrator or trusted contact with recovery rights, in family and business plans.

If none of the four applies to you, the vault is cryptographically closed. Everything below is about which of the four your product offers.

Bitwarden

Bitwarden cannot reset a master password on a personal account. Your options:

• Still logged in somewhere? Open any device where the vault is unlocked, export your vault to a .json file immediately, then change the master password from Account Settings. This is the single most valuable move, and it stops working the moment that session expires.
• Enterprise or family organisation? An administrator with the Account Recovery feature enabled can reset it for you, provided the policy was turned on before you lost access.
• Neither? Delete the account and start over. Bitwarden documents this path precisely because there is no alternative.

Bitwarden’s separate vault PIN is not the master password: it is a local convenience unlock. If you have a PIN set on a device and are still logged in, use it to get in and export.

1Password

1Password’s design is different in a way that helps here: your account is protected by both a master password and a 34-character Secret Key.

• Recovery code. Individual and family accounts can create a reusable recovery code in advance. Using it requires access to your account email, and it issues you a new password and Secret Key. This is the intended path: set one up now if you have not.
• Emergency Kit. The PDF generated at signup holds your Secret Key and, if you wrote it in, your master password. It is a record, not an online recovery mechanism, but without the Secret Key nothing else works.
• Family account. Any family organiser can initiate recovery for another member. This is the most reliable option and a strong reason to use a family plan even for two people.
• Still signed in on a device? Change your master password from that device before the session ends.

Without a recovery code, an Emergency Kit, a family organiser, or an active session, the account cannot be recovered.

LastPass

LastPass offers more recovery routes than most, because it stores a one-time recovery key locally in browsers you have used.

• Password hint, configured in advance, emailed on request.
• Account recovery via a previously used browser, which uses a locally cached one-time recovery one-time password. Use the same browser and device you last logged in from.
• SMS recovery, if you registered a mobile number.
• Recovery one-time passwords you exported earlier.

If you are a LastPass user reading this before anything has gone wrong: confirm your recovery phone number is current, today.

Dashlane

Dashlane cannot reset a master password. It does offer:

• Biometric recovery on mobile, if you enabled it in advance.
• Account recovery key, if you generated and saved one.
• Emergency contacts, who can be granted access after a waiting period you set.

Otherwise, resetting the account deletes the stored data.

Apple Passwords and Google Password Manager

Both are tied to a platform account rather than a separate master password, so recovery routes through Apple ID or Google account recovery, which does exist, and involves identity verification, trusted devices, and waiting periods. This is a genuine convenience advantage of the built-in managers, and the corresponding cost is that your passwords depend on one platform account remaining accessible.

Deterministic managers: a different kind of loss

In a deterministic manager like MoolKey, LessPass, or Spectre, generated passwords are not stored as a vault, so there is no encrypted copy to recover. A forgotten Master Key means the passwords it produced cannot be reproduced.

The recovery path is therefore the same one you would use if your vault were genuinely destroyed: use each site’s own “forgot password” flow, one account at a time, and set a new password as you go. Tedious, but not fatal, because every site you use has its own recovery mechanism independent of any password manager.

This is why the master key deserves a paper backup in a safe place. Not because the system is fragile, but because it is the one thing nobody else holds a copy of.

The universal fallback nobody mentions

Whatever manager you use, if all recovery options are exhausted, you are not locked out of your life. You are locked out of a convenience layer. Every account you hold has its own password reset flow that runs through your email or phone.

The order to work in:

1. Recover your email account first. It is the reset channel for everything else. If you have lost that too, use the provider’s identity-verification process. It is slow, but it works.
2. Then financial accounts, which usually require identity verification rather than email alone.
3. Then everything else, as you encounter it. There is no need to fix 200 accounts in one weekend; fix each one the next time you sign in.

Before this happens again

• Write the master password down and put the paper somewhere physically secure. The threat model for most people is forgetting, not burglary.
• Generate a recovery key today if your manager offers one, and store it separately from the password.
• Set up an emergency contact or family organiser. For two-person households this is close to free insurance.
• Choose something memorable and strong, which in practice means a random passphrase of five or six words rather than a complicated string you will mistype.

How to choose a master password you will not forget covers the memory side in detail.

In short

A forgotten master password is recoverable only through a mechanism you enabled in advance. Bitwarden and 1Password have essentially none without prior setup; LastPass and Dashlane have a few; platform managers route through Apple or Google account recovery. If nothing applies, fall back to per-site password resets starting with your email, and set up a recovery path before you need it next time.