If you think your master password or Secret Key leaked
Remem can’t change a master password or Secret Key. What to do instead: move to a new vault and change the passwords that matter.
Last updated
There is no way to change your master password or your Secret Key in Remem. If you think either is known to someone else, the fix is a new vault.
How bad is it?
- Only the master password leaked: someone also needs your Secret Key, or one of your devices, to open the vault. You have time, but move soon.
- Only the Secret Key leaked (for example, a pairing code or your kit was seen): someone also needs your master password. Move soon.
- Both, or a device plus the password: assume everything in the vault is known. Move now, and change the passwords inside it.
What to do
- Remove any device you don’t recognise or no longer have, in Settings → Sync.
- Save an encrypted backup (or a JSON export), and move to a new vault with a new master password, following “Start a new vault and bring your items across” in Move to another server or storage mode. Choose to delete the old vault account in that procedure.
- If the vault could have been read, change your passwords, starting with the accounts the Security review lists under Accounts that unlock others: your email and sign-in providers.
- Turn on two-factor authentication where you can.
Why removing devices isn’t enough
Removing a device only signs it out. Someone with the device and your master password can sign it back in. Only a new vault, with a new master password and Secret Key, shuts out someone who has both.
Was this missing something? Write to hello@remempass.org.