Docs / Guides

The Legacy Access Kit

The Recovery Kit protects you against forgetting your password. The Legacy Access Kit protects your family against you being unavailable — hospitalised, incapacitated, or gone. It splits your vault's Master Key into three shares where any two open the vault and any one alone reveals nothing at all. No company is involved; no cloud holds anything.

How it works

Keepsake uses Shamir secret sharing (the same maths banks use to split custody of a key). Each share is a short KSE1-… code. The intended split:

1. You keep share 1 — with your papers, or in your password manager.
2. Your designated person (spouse, heir, executor) keeps share 2.
3. A printed share 3 goes somewhere slow and safe — a bank locker, a lawyer's file, or a sealed envelope with your will.

Because any two reconstruct the key, nothing is lost if one share is destroyed, and no single holder can act alone.

Generate a kit

• Windows: Settings → Vault Security → Legacy Access Kit → save the PDF. It prints the three shares, each with instructions for its holder.
• Android: Settings → Legacy Access Kit → confirm your password. The shares are shown once; use Share… to send one to a holder.
• Web app: Settings → Legacy Access Kit. The shares are shown once; use your browser's Print to keep a copy.

Keepsake stores none of the shares — they exist only on the page you save or print.

Using it to open a vault

Whoever holds two shares installs Keepsake, and on the sign-in screen chooses "Unlock with legacy shares" (Windows, Android and the web app all have it), then enters any two of the three. The vault opens with no password. (The vault files must be on that device or reachable through the same sync folder.)

Honest warnings

• Any two shares together are full access. Choose the three holders as carefully as you would choose executors.
• A password change does NOT invalidate old shares — the Master Key survives password changes by design. If you generate a new kit, physically destroy the superseded printouts.
• Losing two of the three shares is unrecoverable — the same as losing your password and Recovery Kit together.

The Legacy Access Kit is always free — like the Recovery Kit, safety is never behind a paywall.

---