Forgot your passphrase?

If you've forgotten your encryption passphrase, your recovery code lets you set a new one. You need the code you saved during setup. See save your recovery code.

How to do it

1. Sign in to Pennyweight as usual. The reset happens after sign-in. Your recovery code doesn't replace your sign-in.
2. On the unlock page, Welcome back, select Use a recovery code instead.
3. On Reset your passphrase, paste or type your code into Recovery code. The hint under the box reads "From your pennyweight-recovery.txt file. Capitalisation and spacing don't matter."
4. Type a new passphrase of at least 12 characters in New passphrase, then again in Confirm new passphrase. The eye icon shows or hides what you typed.
5. Select Reset passphrase. While it works, the button reads "Rewrapping your keys…".
6. On You're back in, select Download reset confirmation (.txt). This saves pennyweight-passphrase-reset.txt.
7. Tick the box that reads "I understand my original recovery code is unchanged and is still the only backstop if I forget this new passphrase."
8. Select Sign in. It stays disabled until you download the confirmation and tick the box. It takes you back to the unlock page, where you unlock with your new passphrase.

Changing your passphrase from Settings opens this same page, so it also needs your recovery code. See change your passphrase.

What you'll see

If the two passphrase fields differ while you type, the form says "Passphrases don't match yet." When you select Reset passphrase, the page checks your entries in this order and shows the first problem in a red box:

• "Passphrase must be at least 12 characters."
• "Passphrases don't match."
• A message that the entry doesn't look like a recovery code: eight groups of six characters after pw-.
• "Recovery code didn't unlock your data. Check it and retry." This means the code is wrong for this account.

A few messages tell you to contact support and say the problem isn't your recovery code. Those point to a data problem on Pennyweight's side. Contact support at pennyweight.ai/contact.

The confirmation file says your encryption keys were rewrapped under the new passphrase, and your transactions were not rewritten.

Good to know

• Your recovery code stays the same. A reset doesn't issue a new code. Your original code is still your backstop. To get a new one, use Regenerate recovery code in Settings → Security. See replace your recovery code.
• Typing the code is forgiving. Capital letters and spacing don't matter, and you can leave off the pw-.
• A failed reset changes nothing. The page says "if anything fails midway, your old passphrase still works." Pennyweight saves the new keys in one step, or not at all.
• Your old passphrase stops working. After a reset, unlock with the new one. This browser's unlocked session is cleared, so you unlock again. See lock vs sign out.
• The two forms check different things. Account setup requires its strength meter to read Strong. The reset form requires at least 12 characters. Its strength meter is a guide only.
• Lose both, lose the data. If you lose both your passphrase and your recovery code, your data is permanently unrecoverable.
• Wrong passphrase, or forgotten? If unlock rejects a passphrase you think is right, check unlock says the passphrase is wrong first.