Recovery flows

Recovery is deliberately stricter than normal device linking. It is for restoring access when setting up a device that was not linked from another trusted device.

Recovery checklist

• Recovery phrase Required for restore. Keep it outside GitVault.
• Current repository access Required to read the existing encrypted vault files.
• Trusted-device approval Preferred when any trusted device is still available.
• New GitHub token Required only for the lost-all-devices path.

Which recovery path to use

Restore with another trusted device

1. 1
   Open GitVault on the new device.

   Choose restore from onboarding or the existing-vault path.

2. 2
   Connect the existing vault repository.

   Use the current repository and current token first.

3. 3
   Enter the recovery phrase.

   GitVault creates a recovery request and waits for another trusted device.

4. 4
   Approve from a trusted device.

   Open Settings, review the request, and approve only if the new device is yours.

5. 5
   Return to the new device.

   Wait for approval or use Check Approval, then verify vault data.

Restore after losing every trusted device

1. 1
   Start the normal restore flow first.

   GitVault first waits for trusted-device approval.

2. 2
   Choose the new-token path only when no device can answer.

   This path is for lost-device recovery, not daily linking.

3. 3
   Create a new GitHub token.

   Create a new fine-grained token for the same private vault repository.

4. 4
   Provide the old and new access context.

   The old token proves access to existing vault storage. The new token proves current control of the GitHub account.

5. 5
   Complete recovery.

   Wait for GitVault to confirm that the vault can decrypt and sync.

After recovery succeeds

• Revoke old token Remove the old token from GitHub after the new token works.
• Review devices Remove any old phone, browser, or machine you no longer control.
• Run sync Confirm the recovered device uploads its current trusted state.

What GitVault cannot recover

GitVault cannot decrypt a vault without the required recovery material. Keep recovery phrase storage independent from your GitVault vault.