Recover your encrypted backups offline

Encrypted backup + password → recover in-app or with the Self-Contained Recovery Kit.

No MyColdKey servers required No login required for recovery Decryption happens locally

Encrypted backup formats: QR · file · ciphertext · SSS shares

Recovery paths

Encrypted backup + password → recover in-app or with the Recovery Kit.

You need

Encrypted backup + password

Standard encrypted backup (QR/file/ciphertext) or Shamir shares (SSS)
Same password for either recovery option

Then choose

Recover in-app

MyColdKey installed

Scan QR Camera + password — decrypt printed or engraved QR.

Import file Select your encrypted backup file and decrypt locally.

Paste text Paste ciphertext (or shares) and decrypt locally.

Self-Contained Recovery Kit (CLI)

Recover on a Windows PC — no app, no login

Import file Decrypt an encrypted backup file via CLI.

Paste text Paste ciphertext (or shares) and decrypt via CLI.

Standard encrypted backups and Shamir shares work with either option. Decryption happens locally.

See Pricing

Self-Contained Recovery Kit (Windows ZIP — no install required)

Exported from inside the app (Lifetime Pro). Recover on any Windows PC with the CLI tools — no app, no login. Windows now, Linux beta, macOS planned.

Get launch updates

GitHub Releases: installers, manual_decrypt, checksums.txt (SHA-256).
Exported from inside the app (Lifetime Pro): Self-Contained Recovery Kit Windows ZIP (recovery_cli + guide); not on GitHub Releases.

Verify downloads with checksums.txt; see verification steps below.

Verify download (SHA-256)

In checksums.txt, find your filename and compare the SHA-256.

Windows (PowerShell)

Expected hash from checksums:

Select-String -Path .\checksums.txt -Pattern "<YOUR_FILENAME>"

Compute actual hash:

(Get-FileHash -Algorithm SHA256 "<YOUR_FILENAME>").Hash

Compare the two.

macOS

grep "<YOUR_FILENAME>" checksums.txt

shasum -a 256 "<YOUR_FILENAME>"

Linux

grep "<YOUR_FILENAME>" checksums.txt

sha256sum "<YOUR_FILENAME>"

Recovery steps Windows now, Linux beta, macOS planned.

Works on any Windows PC — no app, no login.

Windows now, Linux beta, macOS planned.

Download the app & tools from GitHub Releases (or export the Self-Contained Recovery Kit Windows ZIP inside the app).
Extract and run recovery_cli.
Choose standard (single file) or Shamir (SSS) and run the matching command (see toggles below).

Show CLI commands (standard)

recovery_cli standard "your_backup.enc"

Show CLI commands (Shamir / SSS)

recovery_cli sss "share1.enc" "share2.enc" "share3.enc" (enough to meet threshold)

Tools & OS support

manual_decrypt is available on Windows now (Linux beta, macOS planned). recovery_cli is included in the exported Windows ZIP.
Enter your password when prompted. Your secret is decrypted locally.
Use the recovered data to restore access.

In-app: Open MyColdKey → Recover → choose Scan QR, Import File, or Paste Text. Same password and encrypted backup; decrypt inside the app.

Choose your redundancy level: Standard or Shamir (SSS)

Standard backup

One encrypted file (QR, file, or single export). Recover with that encrypted backup and your password.

SSS (Shamir)

Your secret is split into N shares; you need M of N to recover. Use when you want redundancy (e.g. family, multiple locations).

Best for multi-location storage or family recovery.

Store copies across locations

Mix with what you already own — without increasing plaintext exposure.

Print an encrypted QR for your safe

Titanium engraving for disaster resistance

Encrypted file on air-gapped SSD

Optional Cloud+ copy (encrypted backup only; decrypt locally)

Shamir shares for family / multi-location

Your hardware wallet protects the seed phrase. MyColdKey protects the copies — encrypted, replicable, and vendor-independent.

One encrypted backup. Store copies across locations. Control stays with you.

Low-profile redundancy

Recommended for theft-risk reduction; not required for recovery.

Found copies stay encrypted — decryption requires your password.

Copies can be stored alongside ordinary data (QR / file / text) without labeling them as a seed backup.

Create as many copies as your risk model requires — without increasing plaintext exposure.

Optional Cloud+: encrypted backup only; decrypt locally with your password.

FAQ

Can I test recovery before trusting it?

Yes. Create a non-production encrypted backup, then recover it fully offline using the Self-Contained Recovery Kit. Once you’re confident, repeat the same process with your real setup.

What if I lose the password?

Recovery requires the password. If it’s lost, the encrypted backup remains encrypted. Store your password separately from your encrypted backups.

What if I lose some Shamir shares?

With SSS you need only M of N shares. Losing some is OK as long as you still have enough to meet the threshold.

Is login required for recovery?

No. Recovery works without login. Use your encrypted backup + password in the app or the Self-Contained Recovery Kit.

What is the Self-Contained Recovery Kit?

A set of offline recovery tools. GitHub Releases include installers, manual_decrypt tools, and checksums.txt. Export the Self-Contained Recovery Kit (Windows ZIP with recovery_cli + guide) from inside the app.

Which format should I use?

Single backup: Standard (one file or QR). Redundancy or family: SSS. Choose what fits your storage and recovery plan.

Ready to own your recovery?

Get launch updates Back to Home