What to do if…
your password manager stops unlocking and you cannot access your saved logins
Short answer
Stop trying random passwords or “fixes” that could wipe your vault. First, stabilise: try unlocking on a second device/browser, check your device time/internet, and use any built-in recovery option (recovery code, emergency access, family/team recovery) before you reset anything.
Do not do these things
- Don’t uninstall/reinstall the app, delete its data, or “reset” the vault unless you are sure you can sign back in and re-sync (this can erase the only local copy).
- Don’t keep guessing the master password quickly; repeated attempts can trigger lockouts and makes mistakes more likely.
- Don’t follow “recovery” videos/tools that ask you to upload your vault file, export, or share screenshots of recovery keys/QR codes.
- Don’t immediately change lots of account passwords from memory; you can accidentally lock yourself out of the wrong accounts and create more damage.
- Don’t assume it’s “just a glitch” if you also received unexpected login/MFA prompts — treat that as possible compromise and slow down.
What to do now
- Pause and protect what you have. Put the device in a calm, safe state: stop making changes, plug it in, and ensure you won’t lose power mid-process.
- Try the least-destructive unlock checks (2–5 minutes):
- Check Caps Lock/keyboard layout and any password “autofill” oddities.
- Restart the app/browser and the device once.
- Confirm your device date/time is correct (wrong time can break encryption/MFA).
- If it’s a cloud-synced manager, try both online (Wi-Fi/4G) and offline (airplane mode) once.
- Try a second access path immediately (this often reveals whether it’s local or account-related):
- Another signed-in device (phone/tablet/laptop).
- The web vault (if your provider has one) in a private/incognito window.
- A different browser profile (extensions can interfere).
- Check for provider-side issues (quick sanity check). Look for your password manager’s official status page/service incident notice. If there’s an outage, stop troubleshooting and avoid resets.
- Use the provider’s official recovery routes (only what applies to you):
- If you lost your second factor (2FA): use the provider’s saved recovery code(s) (these are usually generated when you set up 2FA).
- If you set up “emergency access” / trusted contact access: request access through that feature (don’t create new accounts or export anything).
- If this is a work/team vault: ask your organisation admin whether account recovery is enabled for your account (some providers support admin recovery for organisation members).
- If you use a family/team plan that supports recovery: ask the family organiser/admin to start account recovery if available.
- Secure the account that can unlock everything: your email. If you can still access your primary email, do this now:
- Change the email password (unique, strong).
- Turn on MFA for the email account.
- Check for new “forwarding rules”/unknown devices and remove anything you don’t recognise.
- If you suspect hacking or fraud (unexpected login alerts, MFA prompts, money moved):
- Run a malware scan on the device you use for passwords.
- Prioritise regaining and securing email first, then banking, then everything else.
- If you received suspicious messages, forward suspicious emails to
report@phishing.gov.ukand forward scam texts to7726(free). - If you need to report fraud/cyber crime: use Report Fraud if you live in England, Wales, or Northern Ireland; in Scotland, report to Police Scotland (use 101 for non-emergencies).
What can wait
- You do not need to reset every password today.
- You do not need to pick a new password manager immediately.
- You do not need to decide whether to make any formal reports right now (unless money is actively leaving accounts).
- You can wait to do “tidy-up” tasks (exports, reorganising vaults, changing security settings across every site) until you’ve regained stable access.
Important reassurance
This situation feels catastrophic because it blocks lots of accounts at once — that reaction is normal. Most lockouts are caused by a small, fixable issue (wrong device path, time sync, extension interference, 2FA access problem), and careful, minimal steps prevent turning a temporary lockout into permanent data loss.
Scope note
These are first steps to stabilise access and avoid irreversible mistakes. If you’re locked out long-term, you may need provider support and a structured “account-by-account” recovery plan starting with email.
Important note
This is general information, not legal, financial, or technical professional advice. Password managers vary: recovery may be limited by design, and some vaults cannot be decrypted without the correct master password/keys. If anything suggests fraud or active compromise, prioritise securing email and financial accounts.
Additional Resources
- https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers
- https://www.ncsc.gov.uk/blog-post/trust-the-tech-using-password-managers-passkeys-to-help-you-stay-secure-online
- https://www.gov.uk/report-suspicious-emails-websites-phishing
- https://www.reportfraud.police.uk/
- https://www.scotland.police.uk/advice/internet-safety/cybercrime/
- https://bitwarden.com/help/lost-two-step-device/
- https://support.1password.com/forgot-account-password/