A password manager account is created with an email address. Protecting that address comes down to three things: a dedicated address used only for the manager, an address that stays active for the life of the vault, and recovery options set up on the first day. That address becomes the login identifier, the destination for verification codes, and the recovery channel for the vault. The four managers covered here, 1Password, Bitwarden, Proton Pass and Dashlane, all use zero-knowledge encryption. Three of the four offer no provider-side reset of a forgotten master password; Proton offers an email or SMS reset that restores the password but not the encrypted data. A vault holds logins, passkeys, card details and secure notes, which means losing the vault means losing the keys to every account stored in it at once.
Recovery limits at a glance#
| Manager | Provider reset of a forgotten master password | Main recovery options |
|---|---|---|
| 1Password | No reset. The Secret Key cannot be recovered. | Recovery codes, Emergency Kit, family organiser or team administrator |
| Bitwarden | No reset. Without a set-up option, the account and its data are unrecoverable. | Emergency access, master password hint, two-step recovery code, organisation administrator |
| Proton Pass | Email or SMS reset restores the password. Encrypted data may stay locked without a separate method. | Recovery phrase, emergency contacts, signed-in reset |
| Dashlane | No reset. No traditional reset process exists. | Account recovery key, biometric recovery, admin-assisted recovery |
The signup address and the vault#
Three functions run through one address. It identifies the account at login, it receives the codes that confirm a new device or a password change, and it is the channel recovery uses. Dashlane states the point in its help centre: even when a contact email is changed, the login still uses the email address used to create the account.
A strong master password guards the vault, but the email address is what keeps the vault recoverable. Recovery options set up in advance are the only way back in, and most of them depend on access to the signup email.
Recovery options by manager#
Bitwarden#
Bitwarden's help page is blunt: the company has no way to access, retrieve, or reset a master password. Zero-knowledge encryption is the reason. The page lists the options in order: check the server region, try another device, use a PIN or biometrics on a device that is still signed in, request the master password hint by email, use emergency access, or ask an organisation administrator if account recovery is enrolled. If none of these grant access, the account and its data cannot be recovered. The account must be deleted and a new one created.
Emergency access is the planned route for individuals. It is available to premium users, including members of paid organisations. The trusted contact needs only a free Bitwarden account on the same server region.
The contact receives either view access, which gives read access to all items in the vault including passwords and attachments, or takeover access, which lets the contact set a new master password and removes the existing two-step login methods. The invitation is valid for five days. When the contact requests access, the account holder can approve or deny it. If there is no response, access is granted automatically after the wait time, which has a minimum of one day.
The two-step login recovery code is generated when a two-step method is set up. It must be saved outside the vault, and Bitwarden cannot retrieve it.
Proton Pass#
Proton Pass is recovered through the Proton Account, so its options follow Proton account recovery: email or SMS recovery, recovery phrase, emergency contacts on a paid Proton plan, and signed-in reset. Password and data are separate problems here. Verification by email or SMS resets the password, yet the encrypted data already in the vault may stay locked until a separate method recovers it.
The recovery phrase, a 12-word sequence, does both at once: it resets the password and recovers the encrypted data. Each phrase works once, so a fresh one is generated after use.
Where the account is still signed in on a device, a signed-in reset applies. With another recovery method enabled, the password changes at once. Without one, 72 hours pass before the reset completes, and Proton notifies the other signed-in devices in the meantime.
1Password#
1Password pairs an account password with a Secret Key to protect a vault. The key is a 128-bit code generated on the device when the account is created, and it is stored on signed-in devices and in the Emergency Kit, a PDF holding the account details and a place to record the account password.
"We don't have a copy of your Secret Key or any way to recover or reset it for you." - 1Password
Without the Secret Key, no one can access the data, including the account holder. For individual and family accounts, recovery codes are the fallback. A code is generated while signed in, and using it requires access to the email address associated with the account.
Timing matters. A recovery attempt made after a recent sign-in is blocked, and 1Password advises waiting at least one hour after creating the code before using it. A blocked attempt leaves the code unusable for 24 hours. After recovery, the account receives a new Secret Key and a new account password. Team and business accounts cannot use recovery codes. A family organiser or team administrator recovers those accounts instead.
Dashlane#
Dashlane holds no copy of the Master Password. The company states that it never stores or shares the Master Password and runs no traditional reset process. Recovery therefore depends on three options, all of which must be switched on before the password is forgotten: the account recovery key, biometric recovery, and admin-assisted recovery for professional plan members.
The account recovery key works once, and only one key is active at a time. A recovery attempt needs an email verification code or a two-factor token, and the step must be completed within 15 minutes. Once recovery succeeds, a new key is generated and stored offline.
With no recovery method switched on, the account must be reset, and the reset erases every saved login and all data. The reset still runs through the email address: a code goes to the login email and must be entered within 15 minutes. Admin-assisted recovery is on by default for professional plans, yet each member still has to acknowledge the prompt in the web app before it covers that member's account.
Choosing the signup address#
Three properties define a good choice for the signup address: it is permanent, it is used for one purpose only, and it forwards to a real inbox that the owner controls and checks.
Permanence#
The signup address has to keep receiving codes for as long as the vault exists, a period measured in years rather than months. Job changes, lapsed domains and abandoned inboxes all end addresses, so none of them is a safe home for the recovery channel.
The alias used for the password manager is the recovery address for the vault that holds every other password. Deleting it, disabling it, or letting it lapse breaks the recovery chain, and the vault can become unrecoverable. Separation is the goal, but the separated address must be a managed, persistent identity, never a short-lived one.
One purpose only#
Sharing the address with newsletters, shopping and social accounts widens its exposure with every breach. Each one puts the address into another dataset. An address reserved for the manager stays narrow: mail that arrives on it from any other sender stands out at once. The same isolation principle applies to banking, where the bank gets a permanent real address used only for financial accounts.
A check on Have I Been Pwned reports whether an address has already appeared in a breach. An address with a clean record is a better starting point than one already circulating in breach data.
A destination inbox that is checked#
Codes arrive on a clock. Dashlane verification codes expire after 15 minutes, and the recovery flows of 1Password and Proton send their codes to the account email. An inbox opened rarely makes a working recovery option useless. The inbox behind the alias therefore needs its own recovery options in place, including a second factor kept somewhere other than inside the vault.
Recovery setup on the first day#
A lockout is too late for setup. Every provider states the same rule in its own words, and the whole setup takes a few minutes on the first day.
The kit comes first. 1Password asks for the Emergency Kit to be saved at account creation; it holds the Secret Key and the setup code. Proton generates a recovery phrase and a recovery kit at signup. Dashlane generates the account recovery key on demand. Paper or encrypted storage outside the vault is where these documents live. A recovery document kept only inside the vault is unreachable at the moment it is needed.
The trusted contact comes next, where the manager offers one. Bitwarden emergency access needs a premium account on the grantor side, and the invitation must be accepted within five days. Proton emergency contacts, available on a paid Proton plan, can change the account password once a waiting period set by the owner has passed. Dashlane admin-assisted recovery covers professional plan members. The contact needs to know where the recovery documents are kept and what to do with them. A contact who does not know the plan cannot carry it out.
Recovery codes and keys follow one rule across all three managers that issue them: they are generated while signed in and stored somewhere reachable without the vault. A 1Password recovery code should not be used straight after a recent sign-in, and 1Password advises waiting at least one hour after creating the code before using it, so the code is generated and then left alone until it is needed.
The second factor is a separate lockout of its own. Losing the device that holds it leaves the account unreachable even with the password in hand, so the second-factor recovery codes are stored with the other recovery documents, outside the vault. Bitwarden's help page notes that losing the two-step device leaves limited options. A saved recovery code and a trusted emergency contact with takeover access are the main routes back.
Testing the setup#
Testing the setup shows whether the plan works. The test is simple: sign out on one device, sign back in with the account password and the second factor, and confirm that the verification code arrives at the signup email. The Emergency Kit or recovery phrase should also be findable in under a minute from outside the vault.
Proton notes that some recovery methods can only be used once, so a real recovery is followed by regenerating the method that was used.
AliasFleet and the signup address#
AliasFleet provides managed email aliases that forward to a real inbox. An alias made for the password manager, used only for that manager and kept active permanently, matches the setup this article describes. The pattern is one alias per service, as described in How to Use Email Aliases: 12 Practical Examples. The manager sees a dedicated address, the real inbox stays unexposed, and the alias can be paused or disabled if mail that is not from the manager starts arriving on it. The free tier includes 10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB monthly forwarding, which covers a dedicated alias for the manager alongside aliases for other services.
The limit sits behind the alias. It is only as reliable as the destination inbox it forwards to. If that inbox is lost, the alias forwards nowhere, and recovery codes sent to the manager address go unread. An alias replaces none of the recovery documents, the recovery code, or the trusted contact. It gives the signup address isolation and permanence, and the rest of the recovery plan is still built around it.
First-day checklist#
- Create a dedicated address used only for the manager, confirm it forwards to a real inbox that is checked regularly, and keep it active permanently.
- Save the Emergency Kit or recovery phrase outside the vault.
- Generate the recovery code or key while signed in, and store it where it is reachable without the vault.
- Set up a trusted contact where the manager offers one, and tell the contact where the documents are.
- Store the second-factor recovery codes with the other recovery documents.
- Sign out on one device, sign back in, and confirm the verification code arrives at the signup address.
