Master password and Secret Key
MimiKey protects your data with two secrets, your master password and your Secret Key. Learn what each one does, where it's kept and what happens if you lose it.
Two secrets
| Master password | Secret Key | |
|---|---|---|
| Created by | You | Your device, at random, when you sign up |
| Looks like | At least 12 characters of your choosing | A string of letters and digits starting with PM-, split into groups by dashes |
| Kept | Only in your memory | On the devices you've signed in on, and in your Emergency Kit |
| You enter it | Every time you sign in or unlock | Only when signing in on a new device, recovering your account or changing your master password |
| Sent to MimiKey | Never | Never |
Signing in and decrypting always need both. Your device combines the master password and the Secret Key to derive your sign-in credentials and your vault key. The server stores only a verifier derived from them plus the encrypted items, and can't work backwards to either secret.
Why two
With a master password alone, your security depends entirely on how hard that password is to guess. Anyone who obtained the server's data could try guess after guess offline.
The Secret Key is a 128-bit random value that exists only on your devices and in your Emergency Kit. Even if the server's data leaked, an attacker couldn't start guessing your master password without it. And someone who steals the Secret Key from one of your devices still can't open your vault without your master password.
For the algorithms involved, see Encryption.
Where your Secret Key is stored
- iPhone: in the device keychain, readable only while the device is unlocked.
- Mac app: in the app's local data.
- Web vault: in the current browser's local storage.
When you sign out on a device, the Secret Key stored there is removed and you'll need to enter it again next time. Forget this device (忘记本机) in the web vault removes it too.
Your Emergency Kit
When you finish signing up, MimiKey shows your Secret Key once and offers to download your Emergency Kit. The Emergency Kit is a text file containing:
- your email address
- your Secret Key
We recommend that you:
- Keep it somewhere you control — an encrypted storage device, or a printout kept somewhere safe.
- Keep it apart from your master password.
- Never send it to anyone, including anyone claiming to be from MimiKey. MimiKey will never ask for your master password or Secret Key.
Note The Emergency Kit doesn't contain your master password. Someone who has it still needs your master password to sign in.
If you lose something
| Situation | What happens |
|---|---|
| You forgot your master password but have your Secret Key | Reset your master password from Forgot master password? (忘记主密码？). See Devices and account recovery. Items encrypted under the old master password may no longer be decryptable afterwards. |
| You lost your Secret Key but are still signed in on a device | Keep using that device. Signing in on a new device requires the Secret Key, so find your Emergency Kit as soon as you can. |
| You lost both your Secret Key and your master password | Your data can't be recovered. The server can't reset or decrypt it for you. |
| You lost a device | Revoke it from another device and change your master password. See Devices and account recovery. |
Account recovery requires your Secret Key. An email address alone isn't enough — otherwise anyone with access to your inbox could take over your vault.
Does changing my master password change my Secret Key?
No. When you change your master password, MimiKey re-encrypts every item under the new password and signs out all of your devices, so you sign back in with the new password. Your Secret Key stays the same and your Emergency Kit remains valid.