The recovery kit

Sempere has no password reset. Each of your devices has its own key, kept in its Keychain, and nobody else has a copy. If every one of those devices is lost, the notes are gone for good, even if every file is still safe in iCloud Drive, unless you kept the vault’s recovery key.

The recovery kit is a two-page PDF with that key on it, meant to be printed and put away. No device keeps the recovery key, so the kit is the one way back in that does not depend on any of your devices.

What it does

With the kit and a copy of the vault you can:

• read the vault, read-only, on any device: the app’s unlock screen (Or read with the recovery key), the web viewer, or the CLI’s --recovery-key;
• take over: make a device the one that manages devices when the old one is lost or stolen, keeping the devices you still have (Take Over with Recovery Kit…). This is also how you start writing again when you have no device left;
• read a note with no Sempere at all, with age, gunzip and jq, as page 2 of the kit explains (Read your notes without Sempere).

The tutorial Use your recovery kit walks through each.

What is on it

• the recovery key as a QR code, and as text in short numbered lines, each with a four-character checksum so a typo is caught;
• the vault’s name, id and creation date;
• the vault’s root fingerprint as 16 groups of four characters, each with its checksum, and as a second QR code. A device that has never seen the vault uses it to check that it opened the real one;
• step-by-step instructions to read the vault with the sempere CLI, and with age, tail, gunzip and jq alone.

Print it when you create the vault

The kit can be printed only once: on the Vault Created screen, right after Create. Under Paper recovery kit, tap Print Recovery Kit…, or Save Recovery Kit as PDF… to print it from somewhere else. The same screen can copy the key (Copy Key, Share…) or save it as a text file (Save to Files…), for example for a password manager.

If you missed it, or lost the kit, replace it on the device that manages devices: Settings ▸ Sync & Devices ▸ Devices ▸ Replace Recovery Kit… (on the Mac, also in View ▸ Vault Keys). Sempere asks for Face ID, Touch ID or your passcode, asks you to confirm each device the vault lists, prints a new kit, and asks you to type one line of the new key back. From then on the old kit is no use for any later change. Files from before the replacement still open with the old key, through old copies of the vault; if that matters, use Re-encrypt Everything… instead (Devices and keys).

From the CLI, on the home device:

sempere recovery replace --recovery-out new-recovery.txt     # shows the devices to confirm
sempere recovery replace --recovery-out new-recovery.txt --keep ID --yes
sempere keys paper --identity new-recovery.txt --vault ~/Notes.sempere --out kit.pdf

The CLI prints US Letter or A4 (--paper a4). keys paper --passphrase prints a kit whose key is locked with a passphrase; the app does not.

The passphrase copy

If you turned on Also store the recovery key under a passphrase, the vault holds a copy of the recovery key locked with that passphrase. It does everything the kit does (read-only access, takeover) with just the passphrase. It sits with the vault on your storage, where anyone with the files can try passphrases offline, which is why Sempere refuses a weak one.

Where to keep it

• On paper, not in the cloud. The PDF is your recovery key in plain text. Delete it after printing; do not leave it in iCloud Drive, email or a shared folder.
• Somewhere safe and somewhere else. A drawer at home is fine for most people; a safe, a bank box or a trusted relative is better for long-term notes. Keep it away from the devices themselves, so one burglary or fire does not take both.
• Labeled. Write which vault it belongs to on the envelope, if you have more than one.
• Checked once. After printing, scan the QR code with any QR reader, or type a line or two, to be sure it is legible. Reading a backup with it in the web viewer is an even better test.

Someone who finds the kit and also gets the vault’s files can read your notes, and could take over the vault. Treat it like the key to your house.

If you lost track of it

As long as the device that manages devices still works, nothing is lost: replace the kit now. If someone else may have it, re-encrypt everything instead. See Troubleshooting.