Owlat Docs

Sealed Mail Recovery Kit

What a Sealed Mail recovery kit is, when it's offered, how to download and store it, how to restore access after a rebuild, and the blunt warning about losing it.

A recovery kit is the private key that opens sealed mail for one of your addresses, bundled with plain-language instructions. It is the only sanctioned way a sealing private key ever leaves the vault in the clear, and it is the only way to restore access to your sealed history if this instance is ever rebuilt.

There is deliberately no admin escrow and no master copy on the server (locked decision D7). That's the whole point of end-to-end encryption: if Owlat could hand your sealed mail to anyone but you, it wouldn't really be end-to-end. The trade-off is that recovering access is entirely on you — hence the recovery kit.

This is the safety net — set it up now

If every recovery kit is lost and the instance secret (INSTANCE_SECRET) is also lost, sealed mail you've already received can no longer be opened by anyone. There is no support ticket, no reset, no recovery. Download a recovery kit for each of your addresses and store it somewhere private and offline before you need it.

When it's offered

Recovery kits are managed by owners and admins in Settings → Sealed Mail. You can download one for any address that has a sealing key, at any time — there's no separate "enrollment" step. The natural moments to do it are when you first turn Sealed Mail on, whenever a new address gets a key, and before any planned server rebuild or migration.

Downloading and storing a kit

  1. Go to Settings → Sealed Mail → Recovery kit.
  2. Enter the address (for example you@your-domain.com) and choose Download recovery kit.
  3. Owlat downloads a single .asc file containing the private key and its instructions.

Then store it well. The instructions inside the kit put it plainly:

Store it somewhere private and offline, like a password manager or an encrypted drive. Anyone who has this file can read this address's sealed mail, so treat it like a spare house key. Do not email it to yourself or leave it in shared storage.

Treat the kit like a spare house key: anyone who holds it can read that address's sealed mail. Keep it out of shared drives and out of your own inbox.

Restoring access

If this instance is rebuilt, restored from a backup, or otherwise loses the keys that open older sealed mail, you'll see sealed messages fall into the "Encrypted — can't decrypt" state. To fix it:

  1. Go to Settings → Sealed Mail → Recovery kit → Restore from a recovery kit.
  2. Enter the address and paste the contents of the kit's .asc file (the -----BEGIN PGP PRIVATE KEY BLOCK----- block).
  3. Choose Import recovery kit.

Once imported, sealed mail for that address can be opened again. If the key doesn't match the address, Owlat refuses the import rather than storing the wrong key.

  • Sealed Mail — what sealing means and how to read the badges.
  • Transport Security — the operator guide, including rotating the instance secret and re-sealing the key vault.
Next Media Library