Understanding Your Encryption Recovery Code

An encryption recovery code is generated during supported encryption setup. Its purpose is to help recover the key used for your encrypted financial values if you forget your password.

Save the code shown by the app in a password manager or another private backup. Do not put it in an email, public post or support message.

Encryption recovery and account recovery are different

PopaDex has both account sign-in recovery codes and encryption recovery material. A code that lets you reset your sign-in password does not necessarily unlock encrypted financial records.

The encryption recovery code is generated from 32 random bytes in the browser. It is used to protect a recovery copy of the data-encryption key; it is not a backup of your account history by itself.

What the current implementation does

The app stores a wrapped recovery key payload and related parameters. The intended recovery flow uses your recovery code to unlock the original data-encryption key and protect it with your new password. It does not need to re-encrypt every financial record simply because the password changes.

The current recovery-code display sends the generated code to the application server to render the dialog. We therefore do not claim that this code never leaves your device or is never available to the server. See the technical implementation.

Local checks found defects in recovery-key setup and password-reset key wrapping. The current password-based recovery flow cannot be relied on to restore encrypted data. Save your code, but preserve any working session and contact support before resetting a forgotten password. If the app reports a recovery error, keep your existing code and any working session, and contact support with the error message only.

If you lose the code

If you can still access your financial data, preserve that access and save any exports you need privately. Do not reset your password just to obtain a new recovery code. Ask support about the options available for your account; support should not ask you to send the password or code.

If you lose your password, usable recovery material and all working key access, encrypted values may be unrecoverable. Resetting account sign-in does not by itself repair that loss.

Before a password reset

Read password reset and recovery. After any recovery attempt, check that your existing account names, balances and history can actually be read before treating the recovery as complete.