Recovery, PIN and reset

Your vault has three ways in: the 12-word recovery phrase, a PIN set in one browser, and passkeys. This page covers each one, what to do when you lose access, and how to reset the vault when nothing else works. For how the vault protects your data, see Security and vault.

All of these settings live in Settings → Account → Vault.

Recovery phrase

OpenLLM has no copy of your recovery phrase and cannot recover it or send it to you. Your browser generates the 12 words when you create your vault, and they never reach our servers in readable form. If you lose the phrase and every other way in, the only way forward is to reset your vault, which deletes what the vault protects.

Setup doesn't show you the phrase. The browser where you created your vault keeps a sealed copy, behind your PIN or passkey. Until you save the words somewhere else, the app shows Save your recovery phrase at the top, and Get started shows Save phrase.

Save your phrase

1. Select Save it now in the banner, or Save phrase on Get started.
2. Enter your PIN, or confirm with your passkey.
3. Choose where to keep the words:
   • 1Password, when the 1Password browser extension is installed.
   • Recovery kit: a printable text file that downloads to your computer.
   • Copy the 12 words and paste them into any password manager.

Keep the phrase where you would keep a master password, away from the devices you use OpenLLM on. Don't store it in a chat, a memory, or a shared document.

View your phrase again

1. Open Settings → Account → Vault.
2. Next to Show my recovery phrase, select Show.
3. Enter your PIN, or confirm with your passkey.

This works only in a browser that keeps a sealed copy of the phrase: the one where you created or reset your vault, or one where you unlocked with the phrase or by approval from another device. Other browsers show Not kept on this device.

PIN and passkeys

A PIN and a passkey open the vault without the phrase.

Set a PIN

1. In Settings → Account → Vault, select Set a PIN on the PIN row. Your vault must be unlocked.
2. Choose a 4- or 6-digit PIN and select Set PIN.

To change a PIN, select Forgot PIN? the next time you unlock, approve from another device or enter your recovery phrase, and choose a new PIN. Or select Forget the vault in this browser, then unlock again and set a new PIN.

Add or remove a passkey

1. In Settings → Account → Vault, select Add next to your passkey type, for example Add Touch ID.
2. Confirm with your device.

To remove a passkey, select its remove button and confirm. It stops unlocking your vault everywhere. Also delete it from your device's password settings.

Choose how long the vault stays unlocked

Under Auto-lock, choose 24 hours (the default), 7 days, or 14 days. This applies to the current browser only. To lock the vault right away, select Lock now.

Approve a new device

A browser or Mac app that hasn't opened your vault before can get it from a device that is already unlocked. No phrase needed.

1. On the new device, choose to approve from another device. It shows a six-digit code.
2. On a device where OpenLLM is open and unlocked, Approve a new device? appears. Type the code from the new device.
3. If the code matches, approve with your PIN or passkey.
4. On the new device, choose a passkey or PIN for next time.

If you didn't ask for a new device, select This wasn't me. Only devices that keep a sealed copy of your phrase can approve.

Lost access

Find your situation below. Try them in order. A vault reset is the last one for a reason.

You forgot your PIN

When you unlock, select Forgot PIN?. Approve from another device or enter your recovery phrase, then choose a new PIN for this browser. If you have a passkey, you can also unlock with it instead of the PIN.

You're on a new browser or computer

Approve it from a device that is already unlocked. See Approve a new device. You can also unlock with your passkey or your recovery phrase.

You lost your passkey

Unlock with your PIN in a browser where you set one, or with your recovery phrase. Then remove the lost passkey in Settings → Account → Vault, and add a new one.

You cleared your browser data

Clearing site data removes this browser's PIN and its sealed copy of the phrase. Unlock with your passkey, by approval from another device, or with your recovery phrase.

You lost your recovery phrase, but can still unlock

Save it again while you still can. In a browser that keeps a sealed copy, use Show my recovery phrase. See View your phrase again.

If no browser keeps a copy, you can keep using your vault through your PINs and passkeys, but nothing will get you back in if you lose those too. To get a phrase you know, reset your vault while you can still plan for it.

You can't sign in to OpenLLM

Your vault is tied to your OpenLLM account, which you sign in to with Google, GitHub, or your email and password. Recover that sign-in first: with Google or GitHub, or with Forgot password? on the sign-in page. If you still can't get in, email [email protected].

You lost everything

If you have no recovery phrase, no PIN in any browser, no passkey, and no unlocked device, your vault can't be opened by anyone, including OpenLLM. Reset your vault and start again. See Reset your vault.

Reset your vault

Deletes:

Keeps:

Reset

1. Open Settings → Account → Vault and select Replace next to Get a new recovery phrase.
2. Read the list of what will be removed, then select Generate new phrase.
3. Save the new 12 words somewhere safe.
4. Select Confirm & commit reset. Until this step you can still select Abort and keep your current vault.
5. Choose a PIN, or turn your passkey back on, for this browser.

After a reset

1. Create a new key in Devices & keys.
2. Re-pair your devices. On each machine, run openllm login and paste the new key, or use Add a device. Give each machine its own key.
3. Reconnect your providers in Providers. See Providers.
4. Update your clients that use an sk-llm-… key directly, such as OPENLLM_API_KEY in scripts or ~/.openllm/.env on machines without the daemon.
5. Add your marketplace keys again in Integrations, if you used your own.

Related

• Security and vault
• Devices
• Troubleshooting
• Privacy

Last updated on