Recovery Phrase or Recovery PIN: which should you use?
The Recovery Phrase is 12 random words. It has far too many combinations to guess in practice, and it also decrypts an Export Package on a new phone. The Recovery PIN is 6 to 12 digits: easier to remember, easier to guess, and it works only on this phone and only from "Forgot your pattern or passphrase?". Use the phrase if you can. Add the Recovery PIN as a second route if you worry about forgetting.
What each one is for
Both do the same job on the phone you have: when you forget your pattern or passphrase, they let you set a new one without touching your items. Neither is a way to unlock the Vault from the lock screen. Only the phrase does a second job: it opens an Export Package on a different phone.
Side by side
| Recovery Phrase | Recovery PIN | |
|---|---|---|
| What it is | 12 words from a fixed English list | 6 to 12 digits |
| Required | Shown when the Vault is created; you can skip writing it down, but should not | Optional |
| Strength | Cannot be guessed | Weaker; short numbers can be guessed |
| Works on a new phone | Yes, with an Export Package | No |
| Shown again | No. Shown once; the app keeps no copy | No. Never shown after you type it |
| Counts toward the guess limit | Yes, if well formed | Yes, if it follows the rules |
| Unlocks from the lock screen | No. Only from "Forgot your pattern or passphrase?" | No. Only from "Forgot your pattern or passphrase?" |
| Included in an Export Package | The phrase decrypts it | Not included |
Why the phrase is strong
Twelve words chosen at random from a list of 2,048 make far too many possible phrases for anyone to try them all. On top of that, the phrase is combined with a secret that lives inside your phone's Secure Enclave, so the words alone open nothing, and the words cannot be used to read your files from another device. Strength has a cost: you must write twelve words on paper and keep the paper.
Why the Recovery PIN is weaker
A six-digit number has a million possibilities. That is far fewer than twelve words, and the app tells you so. It is tied to this phone's secret, and every well-formed try goes through the guess limit: after ten tries in five minutes, each further try waits longer. That makes guessing slow, not impossible. The Recovery PIN is also still awaiting an independent review of its cryptography, and we say so on the limits page What StrongRoom does not protect against
A Recovery PIN also has rules, to rule out the obvious: no repeated single digit, no straight run such as 123456, digits only, 6 to 12 of them.
Which to use
- If you will write the words down: use the phrase and skip the Recovery PIN. One strong secret is better than two.
- If you forget things and the paper may not be to hand: use both. The Recovery PIN gets you back in on this phone; the phrase and an Export Package cover the day the phone is gone.
- If you will not write twelve words down: a Recovery PIN is better than nothing for a forgotten pattern. It will not help if you lose the phone. Make an Export Package anyway; you need the phrase to open it, so decide where the phrase will live.
- Skipping both is allowed. Then a forgotten pattern or passphrase means the Vault is lost.
How to add, change or remove a Recovery PIN
In Settings, open Recovery PIN, type the digits twice and save. The same screen turns it off again. Because it is not part of an Export Package, a restored Vault has none until you set one again.
A tip on the phrase
The words are always English, whatever language the app is in, so that a phrase works on any phone. If you rotate the phrase (Settings, New Recovery Phrase), the old one stops working for that Vault, and an Export Package made earlier still needs the old words. Make a new package after you rotate.
How to use either one when you are locked out
How the phrase and package move a Vault
What is a Recovery Phrase in short
Frequently asked questions
Is a Recovery PIN as safe as the phrase?
No. It is easier to remember and easier to guess. The guess limit slows guessing and it is tied to this phone.
Can the Recovery PIN unlock my Vault from the lock screen?
No. It works only from "Forgot your pattern or passphrase?" to set a new pattern or passphrase.
Can I restore on a new phone with a Recovery PIN?
No. For a new phone you need an Export Package and the phrase.
Do I need both?
No. Either one is enough to get back in on this phone; only the phrase also covers a new phone.
Sources
- None needed: this page states no Apple platform behaviour.