Lock and passphrase: lock times, changes, and forgetting

When it locks

• After the idle time you choose — Lock automatically in the settings: 1, 5 or 15 minutes, 1 hour, or never.
• When the browser closes. You unlock again with the passphrase the next time; nothing keeps you “signed in” across a browser restart.
• When you ask: the Lock button in the panel. In Chrome and Edge you can also give Lock OTP.pink a shortcut in the browser’s extension shortcut settings; in Firefox the lock shortcut has not been checked yet.

Never is there for a computer only you use. What it costs: the vault stays open, and its key available to the extension, for as long as the browser runs.

If you forget the passphrase

There is no reset. Nothing is stored anywhere that could open the vault — not by OTP.pink, not by 301.st — so no one can reset it for you, and that is the point of it.

What is left:

• The printed recovery sheet, if you made one: it holds the keys, so add the accounts again from it.
• An unencrypted export you made and kept: it holds the keys too.
• Otherwise, each site. Your accounts are not lost — the vault is. Sign in to each site with its recovery codes, or through its support, and set up two-factor again.

A .pinkotp file or an automatic backup opens only with the passphrase that was current when it was made — it helps only if you still know that one, from before a change. Making the sheet or keeping a file is on backups.

Changing the passphrase

Settings → Change the passphrase: the current one, then the new one twice. The vault is sealed again under a new key, and from then on it unlocks with the new passphrase.

Exported files and automatic backups made before keep opening with the old passphrase. If you change it because the old one may be known to someone, delete those old files, and export again.

Choose a long passphrase you use nowhere else: the key derivation slows guessing down, it does not make a short one safe. More on the security page.