Skip to main content

Local keys, backup, and recovery

UbID keeps an encrypted local representation of the identity key in the browser. The supplied implementation stores it in IndexedDB and encrypts it with the user's password. Clearing site data can remove that local copy.

Recovery options​

Use the first available method in this order:

  1. Existing local encrypted key — decrypt the saved copy with its encryption password.
  2. Encrypted UbID backup file — import the JSON backup and enter the password used to protect it.
  3. 12- or 24-word secret phrase — import the words in the exact original order.
  4. Cloud/gateway recovery — start the authorized recovery flow and complete FaceTec if policy requires it.

The current Identity Console keeps direct key-data display out of the main navigation. Use the secure-key import or recovery options on the registration/access screen rather than searching for a key display menu.

Recover a key already saved in this browser​

  1. Open Register or the secure-key recovery area.
  2. Select the local identity.
  3. Choose Recover saved key.
  4. Enter the password that was used to encrypt the key.
  5. Wait for the confirmation that the secret key was recovered and loaded.

An incorrect password, damaged encrypted record, unsupported browser decompression, or missing IndexedDB record will stop this method.

Import an encrypted backup​

  1. Select Import encrypted backup.
  2. Choose the UbID JSON backup file.
  3. Enter the backup password and confirm the import.
  4. Check that UbID reports that the key matches the identity and was saved on this browser.
  5. Sign out and perform a complete login test before relying on the restored device.

UbID rejects an unsupported backup version or a key that does not match the stored public identity data.

Import recovery words​

  1. Select Use existing key or Import secret key.
  2. Choose 12 or 24 words as appropriate.
  3. Paste or enter every word in the original order.
  4. Enter and confirm the password that will encrypt the local copy.
  5. Confirm the import and test login.

Do not perform this procedure while screen sharing, in a public place, or on a device you do not control.

Recover through cloud/gateway​

  1. Start Recover from cloud/gateway from the secure-key recovery area or follow the password-reset flow.
  2. Confirm the user ID and new encryption password.
  3. Complete FaceTec when the recovery policy requests facial reverification.
  4. Wait for the success message confirming that the key was recovered and re-encrypted locally.
  5. Test login and then create a new encrypted backup.

Before deleting browser data or a local account​

  • Verify that another active device or approved recovery route exists.
  • Export and test an encrypted backup.
  • Confirm you can access the registered email and any required biometric method.
  • Do not delete the only active device authority. The supplied application blocks local deletion when it can confirm that the browser contains the only active device authority.