If you lose your key

Your hardware key is gone — left on a plane, locked in a defunct laptop, dropped in the ocean. Here is how you get back into your vault.

Before you call

Have these things ready:

Your recovery code (the 48-character 8×6 grid).
The email address on your Clavitor account (for us, to find your vault; the recovery page itself does not ask for it).
Your verification material. If it points to a photo album or video, have it open. If it references specific items, have them within reach to show on camera. If it is a code phrase, remember it.
A new hardware key. You will register it during the recovery flow.

You can buy a new hardware key from any reputable seller — YubiKey, SoloKey, Titan Key, Touch ID on a Mac, Windows Hello on a PC. Clavitor does not care which one.

Reach out

Email support@clavitor.ai. Tell us you need to recover and which account it is for. We will reply and invite you to a Zoom call, scheduled during business hours.

On the call, an operator will pull up your account, see the verification material you set, and walk you through confirming it. This usually takes a couple of minutes.

Once verified, the operator will read you a session code on the call. They will not paste it into the chat, email it after, or message it on any other channel — only verbal, only on the call. Write it down.

Back at your browser

Go to clavitor.ai/recover. The page asks for two things, one after the other:

1. The session code the operator gave you. Click Continue.

2. Your 48-character recovery code. Spaces are ignored. Click Recover vault.

Behind the scenes:

Your browser fetches Clavitor's half of the key.
Your browser does the math to reconstruct the original key on your device.
Clavitor's server never sees the reconstructed key.

If the recovery code has a typo, the browser will tell you before sending anything. A session code works once and for 10 minutes; if it has expired, call back and request a new one. Each new session code cancels the one before it, so only the newest code the operator read you works.

Register your new key

Once the recovery code has opened your vault, the page asks you to register the device that will unlock it from now on: a security key, Touch ID / Windows Hello, or a phone.

Above the device buttons is a checkbox, Remove the vault's other devices (a lost or stolen key stops working). It is ticked by default. Leave it ticked unless you still have one of your old keys and want to keep it.

Choose the device and complete the browser's prompt. Then tap the device twice more: the first tap seals your vault key to it, the second proves it opens. The new device is now a device of the same vault and, with the box ticked, the only one.

The page then says Recovery complete and shows Sign in with your new key. Click it and tap your new key: that signs you in. The page then takes you to your vault, which asks for one more tap of the same key to open it. You are back in.

After you are back

Two things to do, in this order:

1. Generate a fresh recovery code. With Remove the vault's other devices ticked, your old recovery code stops working: it belonged to a key that was just removed, and the recovery page now refuses it. Open Vault → Security, generate a new code, save it somewhere new, and confirm you have saved it. (If you unticked the box, the old code still works; replace it anyway, as it has now been used.)

2. Review your vault's audit log. It shows the recovery: the new device added, and each device it removed, with the actor central:recovery and a reason that starts "vault recovery". Look for anything that was not you. On our side, Clavitor logs every session code an operator issues and who issued it, every release of our half, and every refused session code (unknown, already used, or expired).

That is it. There is no waiting period, no cooldown. Once you are back, you are back.