The short answer
On a true zero-knowledge service, no "reset password" email can get you back in. The provider doesn't hold your keys, so it has nothing to reset to. Your recovery phrase is the only thing that can re-derive your encryption keys: lose your password, use the phrase; lose both, the data is gone, permanently, by design. That last part rarely makes it onto a landing page. It should.
Why "forgot password" can't work here
On a normal cloud service, "reset password" works because the provider can re-encrypt your data with a new key, or never locked itself out to begin with. The convenience and the readability are the same fact: someone other than you holds a key.
Zero-knowledge breaks that. With Beebeeb, your files are encrypted on your device with AES-256-GCM before they ever reach the server. The key that does it is derived from a secret that never leaves your machine. We store ciphertext and a thin layer of metadata, file sizes, timestamps, the owner ID, and nothing we can read. A "reset" email would have to mail you a key we don't have. So we don't pretend to offer one.
This is the tradeoff at the center of every honest end-to-end service. You can have a provider that recovers your account for you, or a provider that genuinely can't read your files. You cannot have both. We picked the second, and the recovery phrase is what makes it survivable.
Three secrets, and which one is actually yours to keep
It helps to stop treating "my password" as one thing. On Beebeeb there are three distinct secrets, and they fail in completely different ways.
Your 12-word recovery phrase is a BIP39 mnemonic generated on your device at signup. Your master key is deterministically derived from it. This is the root of everything, and we never see it.
Your master key is what that phrase produces. It encrypts every file you store, lives only on devices you've unlocked, and gets wiped from memory after a period of inactivity, forcing a re-prompt. It is never written to our servers.
Your password is the one you type day to day. It wraps the master key at rest on each device using Argon2id, and it's the easiest of the three to change, because the master key underneath stays put. The password is local convenience. The phrase is the master secret. People conflate the two, panic when they forget the password, and assume their files are gone. Usually they've just confused the lock on the door with the deed to the house.
What actually happens when you lose access
Run the scenarios honestly, because the outcomes are not the same.
- You forgot only your password. Fully recoverable. Use the 12-word phrase to re-derive your master key on a new device and set a fresh password. No data lost. This is the common case, and it has a happy ending.
- You lost only the recovery phrase. Partial, and time-sensitive. Devices you've already unlocked keep working, but you can't add a new one, and the day you forget the password, recovery becomes impossible. The fix is to open settings on a working device, generate a fresh phrase, and write it down before you close the tab.
- You lost both. Permanent. There is no backdoor and no copy of your master key on our side, so there's nothing for us to reach for. We'll tell you that plainly rather than keep you on hold. The full version, exactly what we protect against and what we don't, lives in our security page and threat model.
How to set recovery up so case three never happens
Case three is avoidable with about two minutes of effort at signup. Here's the setup that holds.
- Write the phrase down on paper. Twelve words, in order. Paper survives a dead laptop and a forgotten password. A note in the same password manager that holds your login is a single point of failure: lose the manager, lose both at once.
- Store it where a thief and a fire won't find it together. A drawer is fine for most people. A safe or a deposit box is better if the account holds something serious. The phrase is bearer access, anyone who reads it and knows your account can derive your keys, so treat it like cash, not like a username.
- Unlock a second device early. A laptop and a phone both unlocked turns a lost password into a non-event: you reset it from the working device without ever touching the phrase.
- Use a passphrase, not a password.
Argon2idslows brute force down hard, but a six-character secret is still six characters. A handful of unrelated words you'll actually remember beats a short clever one you won't. - Re-test recovery once. Sign in on a fresh browser profile using the phrase. If it works, you've proven the paper is correct and you know the flow before you ever need it under stress.
You can see where each of these pieces lives across the product on our features overview: phrase generation at signup, per-device unlock, the inactivity wipe, and recovery from settings are built into how the account works, not bolted on after.
How this compares to other zero-knowledge services
None of this is a Beebeeb quirk. It's intrinsic to end-to-end design, and the honest providers all land near the same place.
Proton uses a 12-word recovery phrase too, and has built a genuinely good story around it. The phrase resets your password and unlocks your encrypted Drive data in one step, and they layer a recovery file and device-based recovery on top as extra nets. Credit where it's due: that's more recovery scaffolding than most services ship. The non-negotiable underneath is identical, without one of those methods, a forgotten password still means permanent data loss.
Tresorit states it bluntly: forget your password while signed out on every device, and your only option is to reset the account, which erases the files. Same tradeoff, fewer rescue paths. (Worth knowing if you're price-shopping: Tresorit’s free plan is a small 3 GB Basic tier.)
Anyone offering a frictionless "reset your password and keep all your files" with no recovery secret in the loop is telling you something important: they can read your files. That's not a recovery feature. It's a key they hold and you don't.
The mindset shift worth making
Moving to zero-knowledge trades one anxiety for another. You give up the comfort of a provider that can bail you out, and you take on the job of guarding one piece of paper. For most people that's a better deal than it sounds: the provider that can rescue your account is, by definition, the one that can hand it to a court, lose it in a breach, or read it on a quiet afternoon.
If you want to feel the difference before committing anything, Generate the phrase, write it down, and watch the recovery flow work once. Two minutes now is the whole story. The version of you who forgets a password next year will be glad you spent them.