NT²
EN

Recovery kit

Last updated: 28 Jun 2026

A recovery kit (`.nt2recovery`) for device loss—not a substitute for `.nt2backup` full vault export.

Who this is for

Vault owners who use threshold Shamir key material and want a path to unlock on a new browser or after device loss—without NT² resetting your password.

What you need

TierFree
Vault stateUnlocked (to export); locked or cold device (to use)
NetworkOffline-capable
Feature toggleThreshold vault (default for new vaults)

Steps

Export a recovery kit

  1. Unlock your vault.
  2. Open Settings → Recovery → Recovery kit (https://se.nt2.me/settings/recovery/recoveryKit).
  3. Export the .nt2recovery file to storage you control (encrypted drive, offline media).
  4. Store it separately from your master password and alongside—not inside—your vault.

Custody: The kit file holds a recovery share (one of three unlock factors) in a form that is not encrypted as a sealed blob. Anyone who obtains the file holds that share. Combined with your master password—or an enrolled device—they could reconstruct vault access. Treat the file like a spare hardware key: keep it offline on media you control; do not email or chat it as a casual attachment; move browser downloads out of a shared Downloads folder.

Use a recovery kit on a cold device

  1. On the unlock screen, select your vault by display name.
  2. When prompted, provide your master password or use Reset password with this device + recovery kit (see unlock-screen flows).
  3. You need two factors among your master password, this device, and your recovery kit—not all three every time.

After changing your master password

  1. Complete Settings → Recovery → Change master password when available.
  2. Export a new .nt2recovery when prompted.
  3. Destroy or securely archive old recovery kits—they no longer match the new password factor.

Tips and common mistakes

  • Recovery kit does not replace regular .nt2backup exports for item data—export both.
  • NT² cannot recover your vault if you lose password, device, and kit with no backup.
  • Never email or message recovery kits; store them separately from your master password (the kit itself is not passphrase-wrapped ciphertext for Share_rec).
  • After a password change, export a new kit and destroy or securely archive old ones.