Designing Password Recovery for an Offline-First Password Manager

I'm designing a password manager app for Android that prioritizes offline first security the idea is to store the vault locally and avoid any cloud dependencies during normal usage. However, I'm currently facing a design challenge regarding the password recovery flow. Since it's meant to be offline, if a user forgets their master password, they can get completely locked out. I'm exploring the best possible recovery mechanisms that strike a balance between privacy, usability, and recoverability. Current Options I'm Considering: Security Questions (Fully Offline) Stored locally, possibly encrypted. User answers them to reset the master password. Problem: If the user forgets both the master password and the answers (or if answers are easy to guess), they’re locked out permanently. Email Based Recovery (Semi-Online) During registration, user provides an email. A password reset token is sent to the email when they initiate a recovery. Vault remains local, but the reset flow uses a minimal backend endpoint to verify the token and allow the user to reset the password. I want the system to be as offline as possible, but not so strict that users are completely locked out if they forget their master password. Currently the only network endpoint is in purchasing a premium subscription for unlocking additional features. Maybe I can add one more additional network endpoint for email password resetting. Any insights or real-world design practices would be very helpful.

Jun 22, 2025 - 00:50

I'm designing a password manager app for Android that prioritizes offline first security the idea is to store the vault locally and avoid any cloud dependencies during normal usage.

However, I'm currently facing a design challenge regarding the password recovery flow. Since it's meant to be offline, if a user forgets their master password, they can get completely locked out. I'm exploring the best possible recovery mechanisms that strike a balance between privacy, usability, and recoverability.

Current Options I'm Considering:

Security Questions (Fully Offline) Stored locally, possibly encrypted. User answers them to reset the master password. Problem: If the user forgets both the master password and the answers (or if answers are easy to guess), they’re locked out permanently.

Email Based Recovery (Semi-Online) During registration, user provides an email. A password reset token is sent to the email when they initiate a recovery. Vault remains local, but the reset flow uses a minimal backend endpoint to verify the token and allow the user to reset the password.

I want the system to be as offline as possible, but not so strict that users are completely locked out if they forget their master password. Currently the only network endpoint is in purchasing a premium subscription for unlocking additional features. Maybe I can add one more additional network endpoint for email password resetting. Any insights or real-world design practices would be very helpful.