What to do if…
your password manager stops unlocking and you cannot access your saved logins
Short answer
Don’t “reset” or reinstall anything yet. First, try unlocking via a second device/browser and use any official recovery route (recovery codes, emergency access, family/team recovery). If there are signs of compromise, secure your email and financial accounts first.
Do not do these things
- Don’t uninstall/reinstall the password manager, wipe app data, or factory-reset a device as your first move (you can erase the only local vault copy or lose the signed-in session you need).
- Don’t keep guessing the master password; rapid retries can trigger lockouts and panic mistakes.
- Don’t use third-party “vault recovery” tools or upload vault files/recovery keys to websites or strangers.
- Don’t start changing lots of account passwords from memory; you may lock yourself out further.
- Don’t ignore unexpected security alerts (new device sign-ins, MFA prompts, missing items) — treat them as potential compromise until proven otherwise.
What to do now
- Stabilize and stop damage. Pause. Plug in your device. Stop making changes that can’t be undone.
- Do fast, low-risk checks (2–5 minutes):
- Verify Caps Lock/keyboard layout (especially if you switch languages/devices).
- Restart the app/browser and the device once.
- Confirm device date/time is correct (time drift can break MFA/encryption flows).
- Try once online and once offline (airplane mode) if the app supports offline unlock.
- Try a second access path immediately:
- Another device where you might still be logged in.
- The provider’s web vault (if available) using a private/incognito window.
- A different browser profile (extensions can interfere).
- Check for a service outage. Look at the password manager’s official status page before you attempt recovery or resets.
- Use the provider’s official recovery options (only what applies):
- Lost 2FA device/codes: use the provider’s saved recovery code(s) (generated when 2FA was enabled).
- Emergency access / trusted contact: initiate the emergency-access request through the app/web vault if you set it up.
- Work/team vault: contact your organization admin to see if account recovery is enabled for your organization.
- Family/team plan recovery: ask the family organizer/admin to run account recovery if the service supports it.
- Secure the account that can reset everything: your email.
- Change your email password (unique, strong).
- Turn on MFA for your email (CISA recommends turning on MFA as a key protection step).
- Check for suspicious forwarding rules/unknown devices and remove anything you don’t recognize.
- If you suspect you were hacked (alerts, unexpected MFA prompts, money moved, new accounts opened):
- Run an up-to-date security scan on the device you use for passwords.
- Follow the password manager provider’s official account recovery instructions.
- If someone used your information, use IdentityTheft.gov to get step-by-step recovery actions and documentation.
- Contact your bank/card issuers using the number on your card (or their official website), and ask about freezes/alerts if needed.
What can wait
- You do not need to reset every password right now.
- You do not need to choose a new password manager today.
- You do not need to do a full “security overhaul” across all accounts until you have stable access again.
- You can postpone cleanup tasks (exports, reorganizing, rotating low-priority passwords) until you’re out of the lockout.
Important reassurance
This feels urgent because it blocks many accounts at once, but most lockouts come from fixable causes (device/app issues, time sync, extension interference, 2FA access problems). Taking slow, minimal steps reduces the chance of losing access permanently.
Scope note
These are first steps to stabilize access and prevent irreversible mistakes. If recovery isn’t possible, the next phase is a structured, account-by-account reset starting with your email, then financial accounts.
Important note
This is general information, not legal, financial, or professional technical advice. Password managers differ: some vaults cannot be decrypted without the correct master password/keys, and providers may be unable to recover data by design. If you see signs of fraud or identity theft, prioritize email/financial security and use official recovery/reporting channels.
Additional Resources
- https://www.cisa.gov/secure-our-world/turn-mfa
- https://www.identitytheft.gov/
- https://www.ftc.gov/news-events/topics/identity-theft/report-identity-theft
- https://support.google.com/accounts/answer/185834
- https://bitwarden.com/help/lost-two-step-device/
- https://support.1password.com/forgot-account-password/