What happens if you lose your 3-word login phrase?

Let's start with the honest headline: if you lose your 3-word login phrase, we can't get your vault back. Not with a support ticket, not with a photo of your driving license, not with a very persuasive email. That's not a policy we chose to be dramatic — it's a direct consequence of how Pwdly is built.

But before you close this tab in a panic: the 3-word phrase is almost certainly stronger than the password you'd have picked yourself, and losing it is far less likely than losing a password you invented. Here's why.

First, a quick correction on the name

You'll sometimes hear this called a recovery phrase, borrowed from the crypto-wallet world. In Pwdly it isn't a recovery phrase — it's your login phrase. You enter it every time you sign in to the dashboard or unlock the browser extension. It's not a backup you tuck away for a rainy day; it's the key you use every day.

That distinction matters. A recovery phrase is something you use once every few years and probably forget where you put. A login phrase is something you use constantly, which means muscle memory works in your favour.

Why we don't have a "forgot password" button

Pwdly is a zero-knowledge password manager. Your 3-word phrase is fed into Argon2id on your device to derive the key that encrypts and decrypts your vault. That key never leaves your browser. What arrives at our servers is ciphertext and metadata — nothing we can turn back into passwords, notes or TOTP secrets.

So when someone asks "can you reset my login phrase?", the answer isn't "we won't" — it's "we can't". There is no key on our side to reset, no admin override, no vendor-side decryption path. If we could bail you out, we could also be forced to bail out an attacker, a subpoena, or a curious engineer. We designed that possibility out of the system.

The 3-word phrase is probably stronger than your usual password

Human-chosen passwords are famously weak in ways humans don't notice. They cluster around names, dates, pets, sports teams and keyboard patterns. Even the "clever" ones — the dog's name plus a birth year plus an exclamation mark — are exactly the kind of thing an attacker with your LinkedIn profile can guess in a shortlist of a few thousand tries.

Pwdly's 3-word phrase is different in three important ways:

• Machine-generated. The words come from a large, curated wordlist and are picked with a cryptographic random number generator. You don't get to "help" — which is the whole point.
• Not social-engineerable. Your phrase has nothing to do with your dog, your school, your street, your birthday, or your favourite band. Someone who's researched you can't shortcut their way in.
• Long enough to matter. Three random words from a large wordlist produce far more entropy than a typical "Str0ng!Password" — and unlike that password, you'll actually remember them.

Add Argon2id on top — deliberately slow, memory-hard, tuned so that even a well-funded attacker with racks of GPUs is looking at a wildly impractical guessing budget — and the practical strength is well beyond the passwords most people juggle across their accounts.

Why it's easier to remember than you'd think

Three concrete words tell a tiny story. "Anchor · Meadow · Trumpet" sticks in your head in a way "Tr0ub4dor&3" never will. The research on this is boring but consistent: humans are dramatically better at recalling a handful of distinct nouns than a scrambled string of characters, and you'll be typing this one at least once per browser session, every day.

You are, quite literally, doing spaced-repetition on your own login phrase without meaning to. Two weeks in, it's yours.

The honest advice: write it down once, safely

Even with muscle memory, the responsible thing to do at signup is capture your phrase somewhere durable and offline:

• Write the three words on paper. A sticky note in a locked drawer beats a photo in your cloud gallery. Store it where you'd store a passport.
• Keep it off the machine you use Pwdly on. A note file on the same laptop is the worst of both worlds — it's discoverable by anything that compromises the device, and it teaches you not to memorise the phrase.
• Consider a second copy for a trusted location. A sealed envelope with a family member, a home safe, a safety deposit box. Physical, offline, deliberately inconvenient to reach — which is exactly right for something you'll rarely need.

This is the same advice a hardware wallet manufacturer would give you, for the same reason: when the vendor genuinely can't help, the paper backup is the safety net.

What actually happens if you lose it

If the phrase is truly gone — no paper, no memory, no backup — the vault is inert. The ciphertext still sits on our servers but is indistinguishable from random noise without the derived key. Practically, you'd:

• Create a new Pwdly account with a fresh 3-word phrase.
• Reset the passwords on the underlying accounts (email, bank, work SaaS) using each site's own recovery flow, and save the new credentials into the new vault.
• Delete the abandoned vault so its ciphertext isn't sitting around indefinitely.

It's a real chore — we won't sugarcoat it. But it's a bounded, one-time chore that stays inside your control, rather than a permanent "the vendor holds a master key to my life" trade-off.

The trade we're making — and why we think it's the right one

Every password manager sits on a spectrum. On one end: vendors who hold enough key material to reset your account for you (convenient, but that same power is available to anyone who compromises them). On the other end: tools where the vendor genuinely can't help (slightly scarier at signup, dramatically safer for the rest of the account's life).

Pwdly sits firmly on the second end. The 3-word login phrase is the price of admission for a vault that even we can't read. In exchange, a breach of our servers, a rogue insider, or a legal demand for your data all hit the same wall — a wall made of ciphertext and math, not policy.

Write your three words down once. Type them daily. Let Pwdly worry about the rest.