Your recovery key unlocks a vault. An encrypted backup carries its files. After losing a device or clearing browser data you may need both, so keep them in different places and check that a restore works before you need one.
What is a recovery key?
Your recovery key independently unlocks the master key of a vault. It is a secret: anyone who obtains it and the vault’s encrypted key material can attempt to open that vault. Save it as carefully as you would save a valuable physical key.
Revault shows the recovery key while you create a vault. The service does not store it in plaintext, and there is no provider-held master decryption key, so nobody at Revault can look it up or reset it for you.
A recovery kit contains the recovery secret and key wrappers, but it does not contain your files. You still need the encrypted cloud copy or a self-contained encrypted backup.
What is in an encrypted backup?
An encrypted backup is a .qvault file that you export from a vault. It contains an authenticated inventory and the vault’s encrypted file segments.
Encrypted backups do not contain your device secret. Use the recovery key to restore a pattern-protected vault. Older vaults may still use their original passphrase.
How do I test a restore?
Export a backup, then choose Restore an encrypted backup and select the .qvault file with its recovery key. Revault authenticates every chunk before it creates any cloud data. The restore creates a new vault with new identifiers, keys and its own new recovery key, so opening a few files in it shows that both the backup and the key work.
Keep an encrypted backup outside this browser, and periodically validate a restore. Browser storage can be evicted, and clearing browser data removes cached encrypted files. An installed PWA is a convenient app experience, not a guarantee of permanent storage.
What if I lose both?
Clearing browser data removes the device secret, so your pattern alone no longer opens the vault there. Getting back in then needs your account’s encrypted cloud copy and the recovery key, or an exported encrypted backup and its recovery key.
If you lose the recovery key and every device that can still unlock the vault, nobody can open it. Revault has no master decryption key, and support cannot bypass the encryption. A backup of a pattern-protected vault cannot be opened without its recovery key, so a backup is no substitute for the key, and the key is no substitute for a copy of your files.
If you think a recovery key has been exposed, move your files into a new vault with fresh keys. Changing your pattern does not change an existing recovery key, revoke another device or invalidate old backups.
Native apps: iCloud or Google Drive sync versus a backup
The native iOS and Android apps need no Revault account and keep vaults on the device by default. Each vault can opt in to private iCloud sync on iOS or Google Drive sync on Android, using your Apple or Google account. Device patterns and unlock secrets do not sync, so a newly connected device still needs the vault’s recovery key.
Sync is not a substitute for an encrypted backup. The iCloud and Google Drive stores stay separate and do not sync with each other, so moving a vault between iPhone and Android, or between the apps and the web app, uses an encrypted .qvault backup. The iOS and Android apps are not yet available in the App Store or Google Play.