Backups: what survives a lost browser or passphrase
What saves you, case by case
| What happens | Automatic backups in the browser | A .pinkotp file you kept |
The printed sheet |
|---|---|---|---|
| A wrong edit or deletion | yes — restore an earlier moment | yes | yes |
| The extension removed, the browser profile lost, a new computer | no — gone with the browser | yes, with its passphrase | yes |
| The passphrase forgotten | no | no | yes — it holds the keys in the clear |
An unencrypted export you made saves you the way the sheet does, and has to be kept as carefully.
The one thing to do today: export a .pinkotp file, keep it outside the browser, and remember its passphrase.
Automatic backups
On every change, the vault is copied into the browser’s own storage, still encrypted; the ten latest moments are kept. Each opens with the passphrase that was current when it was taken.
They live in the same browser profile as the vault, so they share its fate: removing the extension removes them, and someone who can write the profile can reach them too. They undo a mistake; they do not survive the browser.
Described for Chrome and Edge; in Firefox, automatic backups have not been checked yet.
The .pinkotp file
Import and export → Export → Download .pinkotp. The file is the whole vault, still encrypted with your passphrase: keep the file and remember the passphrase — one without the other opens nothing.
The panel reminds you to export after the first account, and again 30 days after an export if the vault has changed since.
Restoring
Import and export → Restore: choose a .pinkotp file, or one of the automatic backups, and its passphrase. The
restored vault replaces the one in this browser, after a confirmation — so export the current one first if you may want
it back.
Counter-based (HOTP) accounts move with the file: stop using them on the device the file came from, or both would give out the same codes.
The recovery sheet
Import and export → Unencrypted export → the format Recovery sheet: the accounts you choose, each with its QR code and, if you ask, the secret as text, in a new tab to print. Anyone holding the sheet can make your codes. Keep it as you keep a passport — somewhere safe, never photographed, never in the cloud.
Moving in and out
In, through Import from another app or by pasting: Google Authenticator’s export QR codes, otpauth:// links and lists (the Standard Backup Format too), and CSV. What comes in is shown as a list to
check before anything is added. A .pinkotp file is not imported but restored, as above.
Out, each behind its own confirmation, because the file holds the secrets in plain text:
- an
otpauth://list — it keeps Steam accounts; - the Standard Backup Format, read by most apps — it holds no Steam accounts;
- an Aegis file, written to Aegis’s published format — open it in Aegis and check the accounts before you rely on it;
- QR pages that Google Authenticator on a phone scans, and a QR code per account from its card.
An export never drops an account in silence: any account the chosen format cannot hold is named, with the reason. Delete an unencrypted file once it is imported.
After a passphrase change
The vault is sealed again under a new key, but files and automatic backups made before keep opening with the old passphrase. If the old passphrase is no longer safe, delete them. More on lock and passphrase.
Moving from a phone app is on moving from Google Authenticator; what the encryption protects against is on the security page.