# Encryption and recovery keys

::: warning
Thymer is end-to-end encrypted, so we cannot do a password reset. If you forget both your password and your Recovery Key, there is no way back into your account. If you use [Markdown Mirror](../markdown-mirror.md), your pages are still in its folder, and if others work in the account, an admin can invite you again or export the workspace.
:::

Your pages are encrypted on your devices before they are synced with the server. The server stores ciphertext (the encrypted version of your data) and never holds a workspace key, meaning we cannot view your notes and files. The [security white paper](https://thymer.com/whitepaper) has the full design, including [Encrypted data and visible metadata](https://thymer.com/whitepaper#visibility).

## Your Recovery Key

You create a Recovery Key when you sign up, and Thymer asks you to type it back to make sure you saved it. Keep it in your password manager, outside Thymer.

If you forget your password, click **Log in with Recovery Key** on the sign-in screen. Enter your email, the Recovery Key and a new password.

**Settings → Recovery Key** makes a new key. It asks for your current password, and the old key stops working.

If you've lost both, other members keep their access, and an admin can invite you again so you can start over. If a device is still signed in, stay signed in until you've saved what you need from it.

## On your devices

A signed-in device keeps the workspace decrypted locally so that search and offline work are instant, and a Markdown Mirror writes plain files. Device security is up to you: screen lock, disk encryption, care with backups and with who can read a mirror folder.

## How the keys work

Each workspace has one key, shared with its members. When an admin approves a new member, the admin's device encrypts a copy of the workspace key for the new member's public key; the server only passes it along. Your own private key is protected by your password (and by your Recovery Key, as a second way in if you forget your password).

## Removing people

Removing a member stops their access from then on. It cannot take back what they already had, and the workspace key is not rotated automatically. If a key must be replaced, move the content into a new workspace.