Remem

Emergency Kit best practices

What the kit is, where to keep it, whether to write your master password on it, and how to make a new copy of your Secret Key.

Last updated

Your Emergency Kit holds your Email (or Signs in as, if you created the vault with a phone number or username), your Secret Key, your Sync server and your Account ID. With your master password, it is what adds a new device to a synced vault. It is shown once, at setup.

Where to keep it

  • Print it and keep the paper where you keep your passport or other important documents. A second copy with someone you trust, or in a safe-deposit box, protects against fire or flood.
  • Don’t keep it only inside Remem. If you are locked out, you can’t read it.
  • Don’t leave the printable HTML file in Downloads, email it to yourself, or keep it in an unencrypted cloud folder. Delete it after printing.

If your vault is This Device Only

The kit shows Sync server: None, and it can’t restore your vault if your Mac is lost: it holds your Secret Key, not your items. What protects you is an encrypted backup. The printed kit says so: “Save an encrypted backup from Settings, keep it somewhere other than this device, and write its passphrase on this sheet.”

Should you write your master password on it?

The printed kit has a blank line for your master password. Filled in, the paper alone is enough to open your vault, so it protects you against forgetting, at the price of making the paper as valuable as everything in your vault.

  • Fill it in if you will keep the paper somewhere truly secure, and forgetting your password is the bigger risk for you.
  • Leave it blank if the paper could be seen by others, and keep the password in your memory only.

Lost your kit but still have a working device

Remem has no screen that shows the Secret Key again, but any Mac that still opens your vault keeps it in the login Keychain. This works whether or not your vault syncs.

  1. On that Mac, open Terminal and run the command below.
  2. macOS asks for your Mac password before it lets the command read the Keychain. Then it prints your Secret Key.
  3. Write the Secret Key down, together with your email, sync server and Account ID, and store it as a new Emergency Kit.
  4. Clear the Terminal window (⌘K) and close it.
security find-generic-password -s ro.pixel8.remem.secret-key -w

You can also find it in the Keychain Access app: search for ro.pixel8.remem.secret-key, open the entry and select Show password.

If someone has seen your kit

The Secret Key can’t be changed, and nor can the master password. If you think both could be known to someone else, move to a new vault.

Was this missing something? Write to hello@remempass.org.