Recovery Code

Danger

Save your recovery code somewhere safe before you close the dialog. Pia does not store it, and the Pia server holds your key only in encrypted form. If you lose this code and all your devices, your encrypted conversations and todos are unrecoverable.

When you turn on End-to-End Encryption, Pia gives you a one-time recovery code — a 26-character code in the format XXXX-XXXX-XXXX-XXXX-XXXX-XXXX-XX. It’s the only way to get back to your encrypted data if you ever lose access to all your devices.

Where to Keep It

Good places:

• A password manager (1Password, Bitwarden, KeePass, etc.)
• An encrypted note on a separate device
• A printout in a locked drawer

Bad places:

• Email or chat — these aren’t end-to-end encrypted, which defeats the purpose
• A plain text file on the same computer — if you lose the device, you lose the code with it
• A screenshot in your phone’s camera roll, especially if it syncs to an unencrypted cloud

When You’ll See It

Pia shows the recovery code immediately after you enable End-to-End Encryption from Settings → Account. The dialog includes:

• A heading: Save Your Recovery Code
• The 26-character code
• A Copy to Clipboard button. The copied code stays out of Windows clipboard history (Win+V) and isn’t shared with your other devices through Windows clipboard sync. You can still paste it as usual.
• A confirmation checkbox: I have saved this recovery code in a safe place
• A Done button (enabled only after you check the box)

The code is shown only once. There’s no “show recovery code again” option later in settings.

Using the Code on a New Device

When you sign in on a fresh device with E2EE already enabled, Pia gives you two ways in:

1. Approve from another device — wait for an approval prompt on a device you’ve already authorized. Best when you have a working device handy. See Cloud Sync.
2. Use recovery code — for when no approved device is available.

To use the recovery code:

1. Click Use recovery code on the onboarding screen.
2. Enter the code in the input field, including the dashes.
3. Click Activate.

Pia validates the code, derives your encryption key, and unlocks this device. Your encrypted conversations and todos start syncing immediately.

With Pia Server 1.4 or later, the server makes sure the code was right: before it activates the device, the device has to prove that it holds your account’s key. Someone who has got hold of your sign-in but not your code therefore cannot activate a device this way. Pia hands the server what it needs for this check by itself, once per account, from a device that holds the key — there is nothing for you to set up.

The recovery code also works on a device that is still set up for your account but has lost its key, for example after signing out. Choose Use recovery code and enter it. The device then keeps its own copy of the key on the server, so later sign-ins take the key back without the code. Approval from another device does not work in this case.

If You Lose the Code

The code is generated only the first time you turn on End-to-End Encryption. Once the dialog is closed, Pia cannot show it again.

If you still have at least one approved device, approve a new device from it now — don’t wait. Beyond that, the recovery code is only needed when you have no approved device, or on a device that has lost its key.

If both the recovery code and every approved device are lost, the encrypted data cannot be recovered.

Next Steps

For the full picture of cross-device sync, see Cloud Sync.