A spare key, not a crossword clue
Think of your Stax Pass password as the key you carry every day. The recovery phrase is the extra key you hide on purpose. In Stax Pass it is a list of 12 or 24 words. Those words are not a riddle. They are another way to unlock the same protected material your password unlocks.
A hotel can keep a master key for every room. That helps staff, and it is dangerous if the master is copied. A house where only you hold the spare is less convenient on a bad day, and more private. Stax Pass is built like the house. Support does not keep a master. The spare is the phrase you write down.
The problem this solves in a password manager
People forget passwords. Phones die. Laptops are replaced. A password manager that encrypts records on the device before sync cannot simply “reset” your vault the way a website resets a login. There is no readable copy sitting in a support tool waiting to be reissued.
That is the privacy tradeoff. Someone who cannot decrypt your saved passwords also cannot help you decrypt them. The recovery phrase is the planned answer: a second path you control in advance, while you still have access.
How Stax Pass treats the phrase
Your password and your recovery phrase are separate paths to the same unlock. Sign-in is designed around OPAQUE (RFC 9807), a password-authenticated key exchange that proves you know the password or phrase without turning those words into a reusable secret on the server. The service can check the proof. It is not meant to store a customer-support list of raw recovery words.
Saved records stay encrypted on your device before they sync, using XChaCha20-Poly1305, a method that keeps contents private and helps detect changes. Argon2id, a memory-hard function that derives protection from a password, is part of the password path. The phrase is not a weaker hint. It is recovery material. Treat it with at least as much care as the password. The security guide shows lost-password, lost-phrase, and lost-both cases in plain language.
What you still have to do
Write the words on paper, or store them offline in a place you can actually reach. Keep them away from the phone you use every day. Do not take a screenshot, email the list to yourself, drop it in a family chat, or keep it in an unprotected note on the same device as the app.
Tell the owner of the vault where it lives—especially in a household. If you help a parent set up Stax Pass, they should know where the phrase is, not only you. Review the hiding place when you move or when a drawer gets cleaned out. A spare key only works if the right person can find it.
Honest limits
If you lose the password but still have the phrase, you have a path back. If you lose the phrase but still have the password, keep using the account and create new recovery protection. If you lose both, and you no longer have an unlocked device, encrypted data cannot be decrypted. That is not a support trick. There is no hidden spare key.
Encryption does not help if the phrase is stolen. A sealed lock does not matter once the spare key is in someone else's pocket. Nobody from Stax Pass will ask you to read the words over the phone. A phishing page can still ask. Protect the paper. Pause before you type those words anywhere that is not the real app.
Is this worth paying for?
A cheap notebook of passwords has no spare key either—it just sits there readable. Stax Pass encrypts records on your device, leaves recovery in your hands, and refuses a company master. That design is the product. Family plans start at $0.99 a month, and the 45-day free trial needs no credit card. You are paying for private storage plus an honest recovery plan, not for someone else to hold a copy “just in case.”
Take this with you
- A recovery phrase is a spare key made of words, not a reminder of your password.
- Store it offline, away from screenshots, email, and the device you use every day.
- If the password and phrase are both gone with no unlocked device, Stax Pass cannot decrypt your records.
Common questions
Can Stax Pass support reset my vault if I lose the phrase?
No. Support has no spare key. If you still know your password, you can keep using the account and should set up new recovery protection. If both the password and phrase are gone and no unlocked device remains, the encrypted records cannot be decrypted.
Is it safe to photograph the words “just for now”?
No. A photo lives in camera rolls, backups, and shared albums. That is a spare key left on the kitchen table. Write the phrase down and put it somewhere boring and offline. “Just for now” has a way of becoming forever.
What if someone tricks me into typing the phrase?
Then they may be able to unlock what the phrase unlocks. Encryption does not stop a stolen recovery phrase. Nobody from Stax Pass will ask you to send those words. Open the real app yourself. Do not type the phrase into a page from a message.