Short answer: if your YubiKey was the only way to unlock some encrypted files, losing it means losing those files. Nobody can recover them for you, including Yubico and the app that encrypted them. If anything else can unlock them (a second key, a recovery code, or your organization's recovery key), you're fine: use that, then register a replacement key.
The rest of this article explains why, what to check first, and how to set things up so that losing a key is an inconvenience instead of a disaster. That matters most for small firms, where the person who loses the key isn't always the person who needs the files.
Accounts and files are not the same problem
Most advice about lost YubiKeys is about logging in. If you lose the key you use for your email or password manager, the service still holds your account. It can check who you are another way (a backup key, recovery codes, or an administrator who resets your sign-in) and let you register a new key.
Encrypted files don't work like that. When an app encrypts a file with a YubiKey, the key itself takes part in the encryption. Nobody holds the file on your behalf and nobody can vouch for you. The only things that can open it are the things that were given a way in when it was encrypted. If the only way in was that key, then no help desk, recovery service or "forgot my key" form exists.
That's not a flaw. It's the reason to use hardware-key encryption at all: a stolen laptop full of files that only your YubiKey opens is a laptop full of noise.
Lost a key? Check these first
Before assuming the worst, go through this list. Most people find a way back in.
- Another key you registered. Many people register a second YubiKey, or Touch ID or Windows Hello on their computer, and forget. If it was used when the files were encrypted, it opens them. In VaultSort, the key list for an encrypted file shows which keys can open it.
- A recovery code. Many encryption tools, VaultSort included, let you create a recovery code that opens files without any key. Look in your password manager, your safe, or wherever you keep important papers.
- Your organization. If your employer set up organization recovery, your administrator can open the files for you. More on this below.
- An unencrypted copy. The file may also exist somewhere else, such as an email attachment, a shared drive, or a backup taken before it was encrypted.
- The key isn't really lost. If you have it but forgot its PIN, that's a different problem. Be careful: on a YubiKey, too many wrong PIN attempts lock the security-key (FIDO2) function, and resetting it erases every credential on it. Stop guessing and check your notes first.
Once you're back in, register a replacement key straight away, and add it to your important files, so you don't end up depending on a single key again.
If that key was the only way in
Then the files can't be opened. Brute force isn't realistic against modern encryption, and the YubiKey's secret can't be copied out of the device, even by Yubico. Anyone offering to "crack" files encrypted with a YubiKey is offering something they can't deliver.
It's a hard sentence to read, and the reason it's at the top of this article: the time to fix it is before a key is lost.
For individuals: always keep a second way in
The rule is simple: never let one key be the only key.
- Register two keys. Keep one with you and one somewhere safe, such as at home or in a safe, and use both when you encrypt. With VaultSort you can use Touch ID or Windows Hello as well, so the computer itself is a second key.
- Create a recovery code and store it offline, away from the computer. It's the way back in if every key is gone.
- Check old files. A second key or recovery code only helps with files encrypted after you set it up, unless the app can add it to older files. In VaultSort, the Key Sync tab in YubiKey Settings does that.
For firms: the person who loses the key isn't the one who needs the files
In a small firm, the files an employee encrypts are usually client files: the firm's responsibility, not the employee's. And there are more ways to lose a key than dropping it:
- someone leaves, and their key leaves with them;
- someone is ill, on leave or unreachable when a file is needed;
- someone dies, and nobody else ever knew their recovery code.
Personal backups don't solve this, because they're personal. The employee's second key and recovery code are in their drawer. What the firm needs is its own way in that doesn't depend on any one person, and that a departing employee can't take with them.
The usual answer, and its problem
Large organizations solve this with key escrow: a central server keeps a copy of every key, or an administrator holds a master key, so IT can always get in. It works, but it needs infrastructure a five-person practice doesn't have. And it puts every key in one place, a single target that has to be trusted, secured and kept running.
Plenty of small-business encryption tools simply don't offer it. Their forums are full of firms asking how to open a departed colleague's files, and getting the same answer: you can't.
What VaultSort does instead: Organization Recovery
VaultSort Business includes Organization Recovery, which gives the firm its own way in without a server and without giving anyone outside the firm a copy of anything.
- Your administrator creates the organization's key on their own computer. It's locked behind their YubiKey and a printed recovery sheet kept in the firm's safe. VaultSort never sees it.
- Each computer joins with a policy file, and checks the organization's fingerprint with the administrator. From then on, every Vault it opens, and everything it encrypts with a security key, gets one extra lock, sealed with the organization's public key. Employees' computers never hold anything that could open other people's files.
- When a key is lost or someone leaves, the administrator opens the organization's key and the recovery console decrypts their files and Vaults. Each recovery is written to a record on the administrator's computer.
Nothing changes for the person doing the encrypting. Their own keys work exactly as before, and the Encrypt card simply says which organization can also recover what they're about to encrypt.
It is honest about its limits. Individual files encrypted with a password aren't covered, and the app says so (Vaults are, however they're unlocked). It's a way back into the firm's own files, not a way to monitor anyone. And it makes no compliance claims. The guide covers all of this, step by step.
Which safety net fits?
| Protects against | Who holds it | Works when the owner has left | |
|---|---|---|---|
| A second YubiKey | Losing one key | The person | No |
| Touch ID / Windows Hello | Losing the YubiKey | The person's computer | Only with that computer |
| Recovery code | Losing every key | Whoever stores it | Only if the firm stored it |
| Organization Recovery | Lost keys, departures, absences | The firm | Yes |
For an individual, the first three are enough. For a firm, the last row is the one that answers "what happens when they're gone?"
A five-minute check
- Every important encrypted file opens with at least two things: two keys, or a key and a recovery code.
- Recovery codes are stored offline, somewhere other than the computer.
- In a firm, the firm holds a way in, not only the employee.
- Older files have been brought up to date (Key Sync, or "Add organization recovery to a folder" for a firm).
- Your offboarding checklist includes keys. See what to do with client files when an employee leaves.
Running a practice? VaultSort Business includes Organization Recovery on every plan, with a 30-day free trial.
Frequently asked questions
Can Yubico recover my encrypted files if I lose my YubiKey?
No. The secret that takes part in the encryption is generated inside the YubiKey and can't be read out, by you, by Yubico or by anyone else. That's what makes it worth using. Recovery depends on whatever other ways in you set up.
Can I make a copy of my YubiKey as a backup?
Not of the part used for this kind of encryption: it can't be copied, by design. The backup is a second key registered alongside the first, plus a recovery code.
I found my YubiKey but it's locked after wrong PINs. Are my files gone?
Not necessarily, but don't reset the key until you have another way in. Resetting the security-key function erases its credentials, and with them that key's ability to open your files. Use your second key or recovery code first.
An employee left and we can't open their encrypted files. What can we do?
Check for another way in: a second key they registered, a recovery code they handed over, or an unencrypted copy somewhere else. If none exists, the files can't be opened; that's what strong encryption guarantees. To make sure it never happens again, keep a firm-held way in, such as Organization Recovery, and add keys to your offboarding checklist.
Doesn't a firm-held key weaken the encryption?
It adds one more way in, and that is a trade-off worth naming. Organization Recovery keeps it small: the firm's key never leaves the administrator's computer except as a sealed backup, it opens only behind their YubiKey or a printed sheet, and nobody outside the firm, including VaultSort, ever has a copy. What it guards against, a firm locked out of its own client files, is far more likely than an attack on that key.
