What to do if…
your password manager stops unlocking and you cannot access your saved logins

What to do now

1. Pause and preserve the device. Keep the device powered, do not clear data, and stop changing settings until you know whether another copy of the vault is accessible.

2. Try the least-destructive unlock checks.

   • Check Caps Lock, keyboard language, copied spaces, and whether autofill has inserted the wrong account password.
   • Restart the password manager app, browser extension, or browser once.
   • Check the device date and time; wrong time can stop time-based MFA codes working.
   • Try online access once, then offline access once if your password manager normally keeps a local copy.

3. Try another access path before resetting anything.

   • Open another phone, tablet, laptop, or browser where the password manager may already be signed in.
   • Try the provider’s web vault in a private window.
   • Try a different browser profile if the problem is in a browser extension.
   • If biometric unlock, Windows Hello, Touch ID, Face ID, or system authentication still works on any device, use that access carefully.

4. If you find an unlocked device, rescue access before logging out.

   • Look for any stored item that contains the password manager account details, recovery code, secret key, or setup details.
   • Follow the provider’s official instructions for recovery or export.
   • If you export a vault, keep the export offline, private, and temporary; delete it securely when you no longer need it.

5. Check whether this is a provider outage or local problem.

   • Use the provider’s official status page or support page.
   • If there is a known outage, stop troubleshooting and wait to avoid making the lockout worse.
   • If only one device fails but another works, treat it as a device or app problem and avoid account resets.

6. Use only official recovery routes that already apply to you.

   • If your provider gave you recovery codes, use the official recovery-code process.
   • If you previously set up emergency access or trusted-contact access, ask that contact to start the provider’s official process.
   • If this is a work vault, ask your organisation admin whether account recovery is available for your account.
   • If this is a family or team plan, ask the organiser or admin whether recovery is available.
   • If the provider says the vault cannot be decrypted without the master password, do not pay anyone who claims they can bypass that.

7. Secure the email account that controls password resets.

   • Confirm you can still sign in to your primary email.
   • Check recovery email, recovery phone, signed-in devices, and forwarding rules.
   • Remove anything you do not recognise.
   • If you can do so without locking yourself out, change the email password to a unique strong password and turn on MFA.

8. If you suspect hacking, fraud, or active loss, prioritise containment.

   • If money is moving or a bank account is at risk, contact the bank using the number in its app, on your card, or on its official website.
   • Secure email first, then banking and mobile phone accounts, then other important accounts.
   • Run a malware scan on the device you use for passwords.
   • Forward suspicious emails to report@phishing.gov.uk.
   • Forward suspicious texts to 7726.
   • If you need to report fraud or cyber crime and you are in England, Wales, or Northern Ireland, use Report Fraud.
   • If you are in Scotland, report cybercrime to Police Scotland online, by phone, or in person; use 999 if there is an immediate threat to life.