Your vault passphrase

Two different secrets

A Relic account has two secrets, both set up during your first run, and they do different jobs. Mixing them up is the most common confusion people have, so it is worth thirty seconds.

Account password

Signs you in to your Relic account, the same way any website does. You can reset it by email if you forget it.

Vault passphrase

Seals the things you save. It never leaves your device, so it cannot be reset. Your recovery kit is the way back if you forget it.

The sign-in screen says the same thing under the Forgot password? button:

Signing in gets your sealed items onto a device. The vault passphrase is what opens them once they are there. How encryption works explains why they have to be separate.

Choosing a good one

As you type, a bar under the field fills up and a small word next to it rates what you have so far: Weak, Okay, Strong or Excellent. Nothing is blocked, whatever the meter says. It is advice, not a gate.

While the rating is Weak, a line appears under the bar:

The Suggest a passphrase button next to the meter writes five ordinary words into the field for you, drawn at random. A phrase like that is easy to write down and hard to guess. Pressing it also reveals the text, so you can read it and save it somewhere, and it clears the repeat field so you have to type the phrase yourself once before it is accepted. The eye button at the right of the field hides or shows what you typed.

Whatever you pick, write it down somewhere safe, and save your recovery kit as well. They are the only two ways into your vault.

Changing your vault passphrase

You can change it whenever you like, from any device that is already unlocked. Relic never asks for the old passphrase, because the device already holds the key it wraps.

1. Open Security
   Go to Settings › Sync and account › Security. On a phone the same Security screen sits in the settings sheet.
2. Open Change vault passphrase
   The row reads Change vault passphrase, with the line Re-wraps your key. Your recovery kit stays valid. Tap it and the fields drop down underneath.
3. Type the new one twice
   The first field is New vault passphrase and carries the strength meter and Suggest a passphrase. The second is Repeat the vault passphrase. If they do not match Relic says Passphrases don't match. and nothing happens.
4. Press Change passphrase
   Relic answers Passphrase changed. Nothing is re-uploaded and nothing is re-encrypted, so it finishes right away.

What a change affects

What changes:

• Your other devices need the new passphrase the next time they ask you to unlock.
• Anywhere you unlock by typing the passphrase, including the vault in a web browser, wants the new one.

What does not change:

• Your recovery kit. It stays valid, because it holds the vault key itself and that key is not replaced.
• Your items. Not one of them is re-sealed, so there is no upload and no wait.
• Sessions that are already running. A device that is signed in and unlocked keeps working until it next locks.
• Your account password, which is a separate thing on a separate screen.

To push every device out of your account instead, that is a different button. See sign out everywhere. The rest of that pane is covered in Settings: Sync and account, and the path to it is Settings›Sync and account›Security.