> ## Documentation Index
> Fetch the complete documentation index at: https://help.primevault.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault Recovery

A simple, guided way to regain control of your vaults if normal access is unavailable.

> [!NOTE]
>
> **When should I use this?**\
> Use Vault Recovery only if PrimeVault services are unavailable and you need to access your assets.

## What you'll need

* **Three Recovery Admins** pre-nominated by your org → any **2 of 3** must participate.
* **Each admin's recovery passphrase** (created in the mobile app during setup).
* Your latest **Encrypted Vault Backup** (download from **Web → Settings → Vault Backup**).
* The **PrimeVault Local Recovery Tool** (runs **offline** on your computer).

> [!NOTE]
>
> **Security at a glance**
>
> * PrimeVault stores **only public keys** for Recovery Admins.
> * Your **encrypted vault state** is stored in **Amazon S3 with delete protection**.
> * The **recovery tool runs locally** and decrypts data using **2-of-3** admin passphrases.
> * PrimeVault cannot view or restore your passphrases or private keys.

## One-time setup (do this once)

1. **Nominate 3 Recovery Admins**\
   Email PrimeVault Support to **whitelist** them for recovery.
2. **Admins set passphrases (mobile)**\
   Each whitelisted admin opens the PrimeVault mobile app and creates a **recovery passphrase**.
3. **Download Encrypted Backup (web)**\
   Go to **Settings → Vault Backup** and download the **Encrypted Vault Backup**.
   * Store it securely.
   * Re-download a fresh backup after material changes to vaults/policies.

> [!NOTE]
>
> **NOTE:** You are ready to recover when…\
> 3 admins are whitelisted, 2+ have set passphrases, and you've stored a current backup.

![Image](https://mintcdn.com/primevaulthelp/v4SUV77yWZrcZbOp/images/image-35.png?fit=max\&auto=format\&n=v4SUV77yWZrcZbOp\&q=85\&s=89601cb03d1a8b1a98821a98806415d2)

Vault Recovery Workflow

## Recover access (step-by-step)

1. **Open the Local Recovery Tool**\
   Launch the offline app. It opens a local interface in your browser.
2. **Enter Admin Passphrases (2 of 3)**\
   Two Recovery Admins enter their **own** passphrases on that machine. *(Passphrases never leave the device.)*
3. **Upload the Encrypted Vault Backup**\
   Select the **latest** backup file you previously downloaded.
4. **Decrypt & retrieve keys**\
   The tool decrypts the backup and shows **per-vault key material**:
   * **ECDSA chains (e.g., Ethereum/EVMs):** Outputs **hex private keys** you can import into wallets like MetaMask.
   * **EdDSA chains:** May **not** produce a conventional private key. Contact Support for chain-specific guidance.
5. **Secure and restore operations**
   * Move funds as needed.
   * **Rotate keys/policies** and restore your standard PrimeVault workflows.
   * Generate and store a **fresh backup** once stable.

## How it works

* Each Recovery Admin's passphrase locally generates a keypair; PrimeVault keeps only the **public key**.
* Your vault state is encrypted to those public keys and stored in **S3** (with delete protection).
* During recovery, the **local** tool uses **any two admins' passphrases** plus the **encrypted backup** to decrypt **on your machine**.
* You receive **per-vault keys** (for ECDSA chains) so that you can import them into a compatible wallet and recover your assets.

![Image](https://mintcdn.com/primevaulthelp/v4SUV77yWZrcZbOp/images/image-36.png?fit=max\&auto=format\&n=v4SUV77yWZrcZbOp\&q=85\&s=5936cab43c0ee151160ff3b85e027bc8)

\[IMAGE PLACEHOLDER 2]

Storage & Retrieval data flow

## FAQs

**Do we need PrimeVault involved during recovery?**\
No. Recovery happens **locally** with your admins and your backup. PrimeVault doesn't see passphrases or private keys.

**Why a 2-of-3 threshold?**\
It reduces single-point risk. Any two trusted admins can recover; one alone cannot.

**What if an admin forgot their passphrase?**\
You can still recover with any of the other **two** admins who remember theirs. If fewer than two passphrases are available, reset your recovery setup first (contact Support).

**Why don't some chains output a private key?**\
Some **EdDSA** ecosystems don't map to a single importable hex key. We provide chain-specific scripts or procedures, so contact Support.

**How often should we refresh the backup?**\
Any time you make **material changes** (new vaults, policies, signers) and at a regular cadence (e.g., monthly or quarterly).

## Need help?

* Whitelisting Recovery Admins
* Chain-specific recovery (EdDSA)
* Validating your backup or tooling

**Contact PrimeVault Support.**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.