What Happens When an Encryption Password Is Lost

Losing the password to an encrypted file feels like losing the key to a safe, but the reality is stricter. A locksmith can drill a safe; nobody can drill AES-256. If a file was encrypted properly and both the password and any recovery key are gone, the data inside is permanently out of reach, for you and for everyone else.

This is not a flaw or a support policy. It is the entire point of the design: the same property that stops an attacker with a copy of your file also stops anyone from 'helping' their way in.

Why there is no reset button

Online accounts can offer password resets because the service controls your data and merely checks your identity before granting access. Client-side encryption is different. SecretPNG derives your encryption key from your password using PBKDF2-HMAC-SHA-256 with 600,000 iterations, entirely in your browser. The password, the derived key, and the file's contents never reach a server, so there is nothing on SecretPNG's side to reset, look up, or hand over.

This architecture is sometimes called zero-knowledge: the service cannot decrypt your data even under legal compulsion or an internal breach, because it never had the means to. The unavoidable trade-off is that key management is fully your responsibility.

The recovery key: a second door, created in advance

When you encrypt with SecretPNG, the data is protected by a random 256-bit file key. That file key is wrapped by your password-derived key, and optionally by a separate 160-bit recovery key, displayed once at creation time in Crockford base32 encoding. If you saved that recovery key, you can decrypt even after forgetting the password.

A recovery key only exists if you recorded it when it was shown. It cannot be regenerated later, because generating it later would require decrypting the file key, which is exactly what a forgotten password prevents.

What you can realistically try

Before treating the data as gone, work through your own memory and records methodically. Most 'lost' passwords are actually misremembered ones.

• Search every password manager, browser-saved password store, and notes app you use, including old devices.
• Try your habitual variations: different capitalization, appended years, keyboard-adjacent typos, and older versions of your usual password.
• Check whether you saved the recovery key: printed sheets, scanned documents, safe-deposit contents, or a recovery code sheet stored with important papers.
• If you shared the encrypted file with someone, ask whether you also sent them the password at the time.

Preventing the next loss

The reliable fix is procedural, not technical. Record the password in a password manager the moment you create it. Save the recovery key when it is displayed, and store it in a different place than the password, such as a printed recovery sheet kept with your important documents. Then verify the whole chain by decrypting a test file before you delete any original.

For long-term archives, add a calendar reminder to re-check access once a year. Ten minutes of verification is cheap insurance against a permanent loss.