# Recovery phrase and shares

How your key is split in three, why any two parts are enough, and why Databeamer cannot reset it for you.

## Three shares, any two will do

Your master key is never stored in one place. During setup it is split into three **shares**:

| Share               | Where it lives                                                  |
| ------------------- | --------------------------------------------------------------- |
| **Device share**    | On each device you have set up, protected by that device's PIN. |
| **Server share**    | On Databeamer's servers. On its own it reveals nothing.         |
| **Recovery phrase** | The 24 words you saved during setup.                            |

Any **two of the three** rebuild the key. Day to day, your device share and the server share do the work. If you lose all your devices, the recovery phrase plus the server share get you back in. You can see this under **Settings › Security › Shares & Devices**.

> **Security details**
>
> - The master key is generated on your device and split with Pedersen verifiable secret sharing at threshold 2. One share alone carries no information about the key.
> - The server share is random and is released only after you sign in. Each device share is random and sealed under the device's PIN with Argon2id. No share is derived from a password or PIN.
> - The recovery phrase encodes 32 random bytes as 24 BIP39 words. A recovery key pair is derived from them; the recovery share is encrypted to that key pair and kept on the server, re-issued whenever the shares change, so the phrase keeps working.

## Why Databeamer cannot recover your account

We hold only one share, and one share is useless. That is the point: nobody at Databeamer, and nobody who breaks into Databeamer, can read your data. The flip side is that if you lose your devices **and** your recovery phrase, nobody can get your data back. Not even us.

Keep the phrase somewhere that survives losing your laptop or phone: a password manager, a printed copy in a safe place, or both.

## Using the phrase

On a new device, choose **Use your recovery phrase** on the **Unlock Your Account** screen, enter the 24 words and choose **Unlock**. The phrase stays valid; using it does not change it.

## Regenerating the phrase

Under **Settings › Security › Recovery phrase**, **Regenerate** replaces the phrase with a new one and invalidates the old one. Do this if:

- the phrase may have been seen by someone else,
- it was stored on a device you have since lost or revoked,
- you never saved it properly in the first place (choose **Generate** if there is none yet).

Save the new phrase just as carefully as the first.

> **Security details**
> Regenerating issues a new phrase and re-keys the shares, so the old phrase can no longer be combined with the server share. The change is written to the audit log as a signed entry.