Getting back into a vault
The vault root key is 32 random bytes and is never derived from your password. Access is through wrappers: a password wrapper using Argon2id with stored, bounded parameters; a recovery-secret wrapper; and a device wrapper bound to operating-system protected storage.
Any wrapper opens the vault, and removing the last one is refused. That is the whole recovery model: keep more than one way in, because there is deliberately no way for anyone else to let you back in.
Decrypting an export without the application
An .otvault archive can be opened with the published Apache-2.0 packages and nothing else — no account, no network. The format documentation gives a short script and, for anyone who would rather not run it, the exact byte-level algorithm: magic bytes, footer, manifest, key derivation, and the frame loop.
The first three steps need no cryptography at all, which is why a recovery tool can show you what an archive contains before it asks for the password.
What recovery cannot do
If the passphrase is lost, the recovery secret is lost, and no device wrapper survives, the data is not recoverable. This is a property of the design, not a defect, and no support process can work around it.
A weak passphrase remains guessable offline from a stolen device whatever the key-derivation parameters are. Choose it accordingly, and keep the recovery secret somewhere that is not the same device.
Source documents
This page summarises the files below. Read them for the full, authoritative text.
docs/formats/OTVAULT_FORMAT.md
Repository pathdocs/security/CRYPTO_PROTOCOL.md
Repository pathdocs/runbooks/BACKUP_RESTORE.md
Repository path