Zero-Knowledge Account Recovery: How to Protect Yourself from Losing Access
Zero-knowledge services like 1Password and Bitwarden can't reset your password—if you lose your keys, your data is gone. Here's how to build your own safety net with a deadman switch. (Killswitch itself moved away from zero-knowledge in 2026.)
Update (2026): This post originally described Killswitch's own zero-knowledge model. Killswitch no longer works this way—password reset is now available, and your vault is encrypted at rest with AES-256 instead. We explain the change honestly in Why we left zero-knowledge behind. Everything below still applies to the zero-knowledge services you probably use every day: password managers like 1Password and Bitwarden, encrypted email, encrypted cloud storage.
Zero-knowledge encryption means no one can read your files—not hackers, not governments, not even the service holding them. Your data is encrypted on your device before it ever leaves it.
But there's a tradeoff: if you lose your password and recovery codes, the service can't help you. There's no "forgot password" email. No support ticket that resets your account. Your encryption keys exist only in your possession.
For these services, that's a feature, not a bug. But it creates a real risk: what happens if you lose access to your own account?
The Problem with Traditional Recovery
Most services store your password (or a hash of it) on their servers. When you forget it, they verify your identity through email, SMS, or security questions, then let you create a new one.
This convenience comes at a cost. It means the service can access your data. It means a hacker who compromises their systems—or convinces a support agent—can access your data too.
Zero-knowledge encryption eliminates this attack vector entirely. But it also eliminates the safety net.
The Solution: A Deadman Switch to Yourself
Here's how to protect yourself without weakening the zero-knowledge services you rely on: create a deadman switch that sends your recovery codes to yourself.
The setup is simple:
- Create a new deadman switch in Killswitch
- Add yourself as the beneficiary (your own email address)
- Upload a file containing the recovery codes for your zero-knowledge accounts
- Set the check-in interval shorter than your other switches
That last part is critical. If you have switches set to trigger after 30 days of missed check-ins, set your self-recovery switch to trigger at 14 days.
How It Works
Normal scenario: You check in regularly. Nothing happens. Your recovery codes sit encrypted, waiting.
You lose access: Maybe you forgot your master password. Maybe your password manager died and took every credential you own with it. Maybe you changed phone numbers and can't receive SMS verification. If you're locked out badly enough that you can't get into Killswitch either, you can't check in.
Day 14 arrives: Your self-recovery switch triggers first. Your recovery codes land in your inbox. You use them to regain access, check in, and reset your credentials.
Day 30 never happens: Because you recovered access and checked in, your other switches (the ones sending files to your family) never trigger.
And for the less catastrophic lockouts: since Killswitch itself now supports normal password reset, you can often just log back in and read your stored codes directly—no waiting for a switch to fire. The self-recovery switch is the backstop for the worst case, when you're locked out of everything at once.
What to Include in Your Recovery File
At minimum, include:
- Recovery codes for your zero-knowledge accounts (password manager, encrypted email, encrypted storage)
- Your master passwords (or hints only you would understand)
You might also include:
- Email account recovery information
- Backup email addresses
Store this as a note within Killswitch, or upload a file. It's encrypted at rest with AES-256 in a dedicated vault—and if the switch triggers, it's delivered straight to you.
A Backup for Your Backup
This approach treats your future self as a beneficiary. You're essentially saying: "If I disappear for two weeks, assume something went wrong and send me my keys."
It's a safety net that doesn't weaken the zero-knowledge services it protects. Your password manager stays zero-knowledge—no support agent there can be social-engineered, because recovery never goes through them. The only way to trigger the delivery is to stop checking in—which is exactly when you'd need it.
Zero-knowledge encryption doesn't have to mean zero recovery options. You just have to build the recovery mechanism yourself.
Related Reading
- Background: what a dead man's switch is and how it works
- Start with the concept: what zero-knowledge encryption actually means
- The flip side of recovery: why "forgot password" is software's most dangerous feature
- Why Killswitch changed models: why we left zero-knowledge behind
Killswitch is an encrypted vault with automated deadman switch delivery. Everything is encrypted at rest with AES-256 and in transit with TLS, and your files go exactly where you want them when you stop checking in. We used to be zero-knowledge ourselves—here's why we changed.