Why SEES has no password recovery
Every reset link is a backdoor with good manners. Here is why SEES refuses to build one, and what that costs you.
A reset link is a backdoor with good manners.
Every service that can email you a recovery link can also read your data, or be compelled to. That is not a criticism of how those services are run — it is a description of what the feature requires. To restore access to data you can no longer unlock, someone else has to be holding a key.
SEES does not hold one. Your passphrase is turned into a key inside your browser and is never transmitted, so there is nothing on our side to reset from.
Forget your passphrase and the vault is gone.
We would rather state this plainly than bury it. There is no reset email, no recovery key, no support process that ends with you getting back in. If the passphrase is lost, the ciphertext stays ciphertext.
Two-factor is a second lock, not a spare key.
You can enable authenticator-app 2FA from Vault Settings. It adds a second local check after your passphrase — it does not recover anything. Losing the passphrase still locks you out, with or without it.
Choose the guarantee you actually want.
If the worst outcome you can imagine is losing your own notes, a service with account recovery is the reasonable choice, and you should use one. If the worst outcome is someone else reading them, the absence of recovery is the entire point.
Read the security model