Your recovery kit, and why we can't reset your password

The one thing to understand

PIToolkit encrypts your cases in your browser before anything reaches our servers, and we hold no key that opens them.

That means: if you forget your password and lose your recovery key, nobody, including PIToolkit, can get you back in. There’s no “reset password” email, because there’s nothing on our side to reset it from. Your recovery key is the way back.

It’s the same design that stops us reading your cases.

What the recovery key is

During signup, your browser creates a 12-word recovery key. It opens your account the same way your password does, like a spare key to your office. You prove you’ve saved it by typing three of the words back.

You can print it, download it or copy it during signup. PIToolkit doesn’t show it again after that. If you lose your copy while you still know your password, make a new one (see below).

Where to keep it

Print it and keep it somewhere physical and secure: a locked drawer, a safe, or with your other important business papers.
Don’t keep it as a photo on your phone or an unprotected file in cloud storage. Whoever has it can get into your account.
Consider telling a business partner or trusted person where the paper copy is. PIToolkit can’t hand it to them.

If you forget your password

On the sign-in page, choose Forgot password.
Enter your email address and all 12 words of your recovery key.
If you use two-factor authentication, enter a code from your authenticator app or a backup code.
Choose a new password.
Save the new recovery key you’re given and confirm three of its words. Your old recovery key stops working.
Sign in with your new password.

Everything in your account is intact. Every device you were signed in on is signed out.

Your recovery key doesn’t replace your second factor. If you’ve also lost your authenticator app and all your backup codes, see Authenticator codes not working.

If you don’t have your recovery key, see Forgot password, no recovery kit.

Making a new recovery key

In Settings, section Account & security, the Recovery key row shows whether yours is ready to use and when you verified it. Choose Generate a new recovery key at any time, for example if you’ve lost your copy or think someone else has seen it. You’ll confirm your password (and a two-factor code if it’s on), save the new words and confirm three of them. Your old key keeps working until you’ve confirmed the new one, then stops working. It doesn’t sign out your other devices. We email you “Your PIToolkit recovery key was replaced”; if you didn’t do it, change your password straight away.

Changing your password

Change your password in Settings, section Account & security, Password, with a two-factor code if it’s on. Your existing recovery key still works afterwards, so you don’t need a new one every time. Every other device you’re signed in on is signed out, and if you use two-factor authentication, you’re given new backup codes.

If you changed your password because someone else may have had it, also make a new recovery key: whoever had your password could have set one up. Settings offers this straight after the change. See Changing your password.

Replacing your account key

Replace my account key, in Account & security, goes further. It replaces the key that protects everything in your account, gives you a new recovery key and signs out your other devices. Use it if you think your password or recovery key has been exposed. It protects what happens next, but anything already copied stays readable with the old key. You’re also offered it after a password change or a recovery. See Replacing your account key.

What we’ll never ask for

PIToolkit staff will never ask for your password, your recovery key or a two-factor code, by email, phone or support request. If anyone claiming to be PIToolkit asks, it isn’t us.