Recovery, end to end
How to recover a DMSKey vault from printed share cards.
Bring the required number of cards, import them into the recovery tool, and decrypt the vault locally. No account or payment is required to open an existing vault.
- No account
- Local decryption
- Recovery is always free
Recovery in four moves
A schematic walk-through of what the heir sees in the recovery tool. You need at least K valid share cards from the same vault, a modern browser, and ideally the offline recovery package stored with the cards.
For the person who will actually open the vault
If someone gave you a DMSKey share card, this page explains how many cards are required and how to recover the vault. Vault creators should also walk through this process before distributing the cards.
Why this is the recovery flow you actually want
Designed to work without the hosted site
The recovery flow is intended to be runnable from an offline package containing the recovery code, a checksum, and the documented vault format.
Heir-readable, not engineer-readable
No command line, no JSON to hand-edit, no key file to hunt for. The page tells the heir what is loaded and what is missing.
Recover vs Verify
Recover reconstructs the key and shows the vault contents. Verify runs the same path but never renders the contents — the right tool for rehearsing recovery without exposing the secret.
Threshold enforced by the math
If a single custodian opens their card alone, they see a QR and a string of base32. A valid set of fewer than K shares does not reveal the protected secret.
Why people choose DMSKey
- Client-side cryptography
- No account required for recovery
- Open recovery process
- Printable paper artifacts
- Threshold recovery (K-of-N)
- One-time payment
- Recovery survives a lost or destroyed card when you choose N greater than K
Recovery is always free
There is no paywall on the recovery tool. The free tier creates 2-of-2 vaults that recover exactly the same way as DMS Full's larger K-of-N vaults — same import flow, same wizard, same crypto.
- Any K-of-N up to 255 shares
- No watermark
- Printable executor letter PDF
- Free recovery, forever
Recovery questions
How do I recover a vault from printed share cards?
Gather any K of the N cards the vault was created with, open the recovery tool on a trusted device, and import the cards (scan, drop, paste, or upload). Once K valid shares are loaded, the tool reconstructs the recovery key locally and decrypts the vault.
What if I only have K-1 cards?
Recovery is not possible with fewer than K valid shares. There is no progress bar, no partial decryption, no hint about the contents. Find one more card or, if no more exist, the vault cannot be opened.
What input methods does the recovery tool support?
Scanned or uploaded photos of the printed QR, share JSON files from the original .zip, the printed human-readable text block (pasted or uploaded), and a PDF page of the card. The CRC-32 on each card catches typos and partial reads.
What if the QR codes do not scan properly?
Each card carries the same data in both a QR and a grouped base32 text. If the QR is scratched or smudged, type or paste the base32 text instead. If the text is faded, scan the QR.
What errors might the recovery tool report?
Duplicate card — the same share is loaded twice; remove the extra. Invalid checksum — the CRC-32 failed; re-scan or re-type the share. Cards from different vaults — the vault ID does not match; only cards from one card set can be combined. Insufficient shares — fewer than K valid shares are loaded; find one more card. Damaged QR — the QR is unreadable; type the base32 fallback instead.
Does the recovery contact the DMSKey backend?
The intended application flow does not send vault contents, recovery keys, or share contents to the DMSKey backend. Decryption runs in your browser inside a dedicated Web Worker.
What if dmskey.com is unavailable when my family needs it?
Store the official offline recovery package generated with the vault, together with its checksum and instructions. The printed cards remain usable with a compatible implementation of the documented vault format.
Set up a vault you would trust your family to open
Now that you have walked the recovery path, set up the vault on the other side of it. Create a vault, print the cards, then come back to the recovery tool and run a full dry-run before you hand anything out.