# What a recovery phrase is, and how to store it safely

> A recovery phrase is the spare key to your encrypted data. What it is, why nobody can reset it for you, and practical ways to keep it safe and offline.

Published 2026-11-01 · https://vaultcave.app/blog/recovery-phrase-how-to-store-it

A recovery phrase is a short list of ordinary words, usually 12, that works as the spare key to something encrypted. If you forget your password, lose your phone or need to restore a backup, the phrase is what lets you back in. Because it's a key and not a password reset, nobody else can recover it for you, so where you keep it matters as much as the phrase itself.

This guide explains how recovery phrases work and the practical, low-tech ways to store one safely.

## Why some apps give you a phrase instead of "forgot password"

Most apps let you reset a forgotten password because the company holds your data, or a way to unlock it, on its servers. That's convenient, but it also means the company (and anyone who breaks into it or compels it) can get at your data.

Apps built around **end-to-end** or **local** encryption work the other way: the key that unlocks your data exists only on your side. That's what makes them private, and it's also why there's no reset button. If the company could reset your password, it could open your data too.

The recovery phrase solves the "what if I forget?" problem without handing anyone else a key. It's generated when you set things up, shown to you once, and from then on only you have it.

## What the 12 words actually are

Many apps use a standard word list called BIP39: 2,048 common English words chosen so that no two are easily confused. Picking 12 of them at random gives roughly 128 bits of randomness, far more than anyone could guess, even with a computer trying billions of combinations.

A few things follow from that:

- **The order matters.** The same words in a different order are a different phrase.
- **Every word matters.** The last word usually includes a checksum, so a typo is caught rather than silently opening nothing.
- **You don't choose it.** Phrases people pick themselves (song lyrics, favourite quotes) are far easier to guess. Good apps always generate it for you.

In VaultCave, every vault gets its own 12-word phrase when you create it, and you type back three of the words to prove you've written it down before the vault is ready. The phrase is the only way to restore a vault from your encrypted backup, and the only way in if you forget the vault's pattern.

## Where *not* to keep it

The whole point of a recovery phrase is that it survives when other things fail: a lost phone, a dead laptop, a hacked account. So avoid storing it anywhere that fails at the same time:

- **Not as a screenshot or photo.** It lands in your photo library, syncs to the cloud and is the first place anyone would look.
- **Not in the Notes app or an email to yourself.** Same problem: it lives on the devices and accounts it's meant to protect.
- **Not inside the thing it unlocks.** A vault's phrase stored inside that vault is useless the moment you need it.
- **Not in a cloud document** unless that document is itself protected by something you'll never lose access to.

## Good ways to store it

Low-tech is usually best:

1. **Write it on paper.** Number the words, write clearly, and double-check every word against the screen. Pencil fades less than many inks.
2. **Keep it somewhere safe and private**: a home safe, a locked drawer, or with your important documents such as passports and property papers.
3. **Consider a second copy in a different place**, such as a trusted family member's home or a bank safe-deposit box, so a single fire or flood can't take both.
4. **For long-term durability**, some people stamp or engrave the words on metal plates made for exactly this.

If you keep it with family, think about who should be able to use it. Someone with your phrase can open what it protects, so share it only with people you'd trust with the data itself.

## Should you use a password manager?

A password manager is a reasonable place for a recovery phrase if you're confident you'll never lose access to the password manager itself, and if it's protected by a strong master password and two-factor authentication. It's convenient and encrypted.

The risk is circular dependency: if your phone is lost and your password manager is only unlocked by that phone, you can be locked out of both. If you go this route, keep a paper copy too.

## Test it before you need it

A phrase you can't read in two years is no better than no phrase. Once in a while:

- Check that the paper is still where you think it is and still legible.
- If the app lets you, verify the phrase without changing anything (VaultCave asks for three words back at setup; the full phrase works any time from **Restore with recovery phrase** on the unlock screen).
- If you ever think someone has seen it, move your data to a new vault with a new phrase.

## The short version

- A recovery phrase is the spare key to encrypted data; nobody can reset it for you.
- It's generated randomly from a standard word list; order and every word matter.
- Never store it as a screenshot, in Notes, in email, or inside the thing it unlocks.
- Write it on paper, keep it somewhere safe, and consider a second copy elsewhere.
- Check it now and then, so it works on the day you need it.