Emergency Access

Your vault holds the keys to your entire digital life — bank accounts, medical portals, business logins, crypto wallets, insurance documents. If you become incapacitated or pass away, that critical information could be locked away forever.

Emergency Access solves this problem without compromising security. Instead of writing your master password on a sticky note (please don't), you set up a cryptographically secure trust relationship with someone you choose. They can never peek at your data behind your back — every access request triggers a notification and requires your explicit approval.

Emergency Access is built on a simple, auditable flow with five clear stages:

1. Invite — You send an invitation to someone by email. They receive a notification that you'd like them to be your emergency contact.
2. Accept — The invitee signs in to Passwall and accepts the invitation, confirming their identity.
3. Confirm & Key Exchange — You confirm the relationship. Behind the scenes, your User Key is encrypted with the contact's RSA public key and stored on the server. This key exchange is the cryptographic foundation that makes zero-knowledge emergency recovery possible.
4. Request & Approve — When the emergency contact needs access, they submit a recovery request. You receive a notification and can approve or reject it instantly.
5. View Vault — Once approved, the contact decrypts your User Key with their own RSA private key and can view your personal vault in read-only mode. After the session, the access resets automatically.

Setting up Emergency Access takes less than two minutes:

1. Go to Settings → Emergency Access in the web vault.
2. Click Add Trusted Contact and enter the email address of the person you trust.
3. They'll receive an email invitation. Once they accept, you'll see their status change to "Accepted."
4. Click Confirm next to their name. This triggers the secure key exchange — your User Key is encrypted with their public key.
5. Done! Their status will show "Confirmed" and they can now request access in an emergency.

If you're someone's trusted emergency contact, here's how the process works from your side:

1. Go to Settings → Emergency Access. You'll see a "People Who Trust Me" section.
2. If an invitation is pending, click Accept to confirm your role as their emergency contact.
3. When you need access, click Request Access. The vault owner will be notified immediately.
4. Once the owner approves, a View Vault button appears. Click it to decrypt and view their personal vault in read-only mode.

The vault view is read-only — you can see the credentials but cannot edit, delete, or export them. After you close the vault viewer, the access automatically resets back to the confirmed state.

Emergency Access is designed with the same uncompromising zero-knowledge architecture that protects every piece of data in Passwall:

• RSA key wrapping — Your User Key is encrypted with the trusted contact's RSA-OAEP public key. Only their corresponding private key can decrypt it. The server stores only the encrypted blob.
• No master password sharing — Your master password is never transmitted, stored, or shared. The underlying User Key (derived during account creation) is what gets wrapped — and it never changes when you update your password.
• AES-256-CBC + HMAC-SHA256 — All vault items remain encrypted with this symmetric scheme. The trusted contact decrypts your User Key first, then uses it to decrypt individual items — entirely in their browser.
• Server is blind — Passwall's servers never see your decrypted User Key or any vault contents. We facilitate the key exchange, but we cannot read the data.
• Personal vault only — Emergency Access provides access to your personal vault. Organization and shared team vaults are not exposed, protecting corporate data boundaries.

You have full control over your emergency contacts at all times:

• Revoke anytime — Remove a trusted contact instantly. Their encrypted key copy is deleted from the server and they can never request access again.
• Reject requests — If a recovery request seems suspicious or premature, reject it with one click. The relationship stays intact for future legitimate requests.
• Multiple contacts — Add as many trusted contacts as you need. Each one has an independent key exchange and separate approval flow.
• Status visibility — See the real-time status of each relationship: Invited, Accepted, Confirmed, Recovery Requested, or Approved.

Passwall sends email notifications at every critical step to keep both parties informed: