Use your recovery kit

You need: the printed recovery kit (or the vault’s passphrase, if you made a passphrase copy) and a copy of the vault.

The kit holds the vault’s recovery key and the vault’s root fingerprint. The key reads the vault, read-only, and can take over managing devices. The root lets a device that has never seen the vault check that it opened the real one. The recovery kit says what is on it.

Test it once

Do this soon after printing, not on the day you need it.

1. Scan the kit’s QR code with any QR reader, or type the first line, to be sure the print is legible. Every line ends with a four-character checksum; printf '%s' 'THE LINE' | sha256sum | cut -c1-4 recomputes it.
2. Open a copy of the vault with the key, read-only, as below. If a note opens, the kit works.

In the app: read only

On a device that has no key for the vault (for example after Open Vault…), the unlock screen offers:

• Or read with the recovery key: paste or type the key, then Unlock with Key;
• Or the recovery key’s passphrase: the passphrase of the vault’s passphrase copy, then Unlock.

The vault opens read-only: you can read, search and export, and nothing is changed. The device does not become one of the vault’s devices.

In the app: take over

To write again, or to manage devices when the home device is gone: Take Over with Recovery Kit…, on the unlock screen or in Settings ▸ Sync & Devices ▸ Devices.

1. On an iPad or iPhone, Scan QR Code… and scan both codes on the kit: the key, and the root next to it. Or type the key and the 16 groups of the root; each group’s checksum catches typos. With the passphrase copy, type only the passphrase: it carries the root.
2. Continue, check the devices to keep, Take Over.

The recovery key is used for this one signature and is not kept on the device. Every other device shows an alert that a takeover happened. See Replace a lost or broken device.

In a browser

The web viewer opens a vault folder (or a WebDAV share) and reads it with the recovery key pasted in, or with the passphrase of the passphrase copy. Nothing is sent anywhere. Try it on a backup.

With the CLI

Type the key lines into key.txt, one after another without the line numbers and checksums (or zbarimg --raw -q photo.png > key.txt from a photo of the QR code), and keep it private:

chmod 600 key.txt
age-keygen -y key.txt | tr -d '\n' | sha256sum | cut -c1-16   # compare with the digest on the kit
sempere vault verify --vault ~/Notes.sempere --recovery-key key.txt --root "THE 16 GROUPS ON THE KIT"
sempere export --all --format pdf --out ~/notes-pdf --vault ~/Notes.sempere \
    --recovery-key key.txt --root "THE 16 GROUPS ON THE KIT"

--recovery-key is read-only: every command that would write refuses. With only the passphrase copy, pass it as the key (--recovery-key Notes.sempere/keys/recovery-*.key.age) and type the passphrase when asked; it carries the root, so --root is not needed.

Afterward, delete key.txt.

With no Sempere at all

Page 2 of the kit has a short script for age, jq, tail and gunzip. Read your notes without Sempere walks through it.