The Password Manager Emergency Sheet: What to Write Down and Where to Keep It
A password manager you cannot open is just a very secure paperweight. The emergency sheet is the backup plan for the one password that unlocks all the others, and it belongs on paper, not in the cloud.
My password manager currently holds 214 logins. I could log into exactly one of them from memory: the manager itself. Everything else is a random string I have never seen with my own eyes. That single point of failure is the entire game of password management, and the emergency sheet is how you survive it.
The idea is simple enough that people dismiss it, which is exactly the problem. A password manager emergency sheet is a physical piece of paper carrying everything you need to recover your vault if you forget the master password, lose your phone, or end up in a hospital bed. Bitwarden's own community treats it as standard practice, and there are printable templates for it. It is not a printout of your passwords. You do not need the 214. You need the keys to the keys.
What goes on the password manager emergency sheet
Mine has 5 things, and I would argue for exactly these 5 and nothing more:
- The master password, written in full. Mine is a 7-word diceware passphrase. Write it by hand, legibly, and double-check every word. This is the single most important line on the page.
- Your 2FA recovery codes. If you lose your phone, your authenticator app goes with it, and without the recovery code you are locked out of the one account that matters most. In Bitwarden, the two-step login recovery code lives in the web vault under Account Settings. Write it down when you enable 2FA, not after the phone is gone.
- Your email account's password and its backup codes. This one surprises people, but it is the chicken-and-egg problem: nearly every account recovery on the internet routes through your email, and your email password lives in the vault. If you cannot open the vault and cannot open your email, you are done. The sheet breaks the loop.
- The vault export password, if you keep password-protected exports of your vault. An export you cannot open is not a backup.
- A one-line note saying what the sheet is. Something like: "Password manager recovery sheet. If I am incapacitated, this plus my laptop restores access to my accounts." Future you, or your spouse, will be grateful.
Where it lives matters as much as what is on it
Two copies, two locations, sealed envelopes. One copy goes somewhere fire-resistant at home: a document pouch or a safe. The other goes off-site: a safe deposit box, or a sealed envelope with someone you trust. A fire that takes your laptop and your only copy of the sheet takes everything.
Label it honestly but boringly: "Password recovery" rather than "MASTER PASSWORDS." The realistic threat here is not a burglar targeting your passwords. It is you, in 6 months, staring at a login screen after a year of unlocking with your fingerprint. Bitwarden is designed so you can stay logged in indefinitely with a PIN or biometrics, and that convenience is exactly why the master password fades from memory. The people who skip the sheet are usually the technical ones who are sure they will not forget. Memory fails in the most boring ways: a new phone, a concussion, a year of never typing it.
What does not go on the sheet
Do not photograph it. A photo of your master password synced to cloud storage turns your backup into a leak with extra steps. Do not store a digital copy in your email or notes app: the sheet exists precisely for the scenario where those are unreachable. And do not print your full vault on it. Hundreds of passwords on paper is a liability, not a backup, and you would never update it.
Do update the sheet when the inputs change: new master password, new 2FA, new export password. Once a year, pull it out and check it is still current. A stale emergency sheet is a trap. It gives you confidence right up until the moment it fails.
The step everyone skips
If you take one thing from this: after you finish reading, open your password manager's settings and look at your 2FA recovery code. If you cannot put your hands on it in 30 seconds, you do not have a backup plan. You have a hope. The sheet takes 15 minutes. The lockout it prevents takes weeks to unwind, if it can be unwound at all.
Start with the most important line. The first thing that goes on the sheet is a master password worth writing down. Generate a diceware passphrase now: 7 words if it is the one password you will memorize. Then make that the first line you write.
Frequently asked questions
Should I really write down my master password?
Yes. An encrypted vault plus a written master password kept in a separate physical location is the standard recommendation across the password manager community. The threat the sheet protects against is lockout and memory loss, which is far more common than a burglar targeting your paper.
What if someone steals the emergency sheet?
They would still need access to your devices and accounts to use most of what is on it. Treat the sheet like a house key: sealed envelope, kept somewhere private, with a second copy off-site. The realistic risk of permanent lockout is much higher than the risk of targeted physical theft.
Where do I find my 2FA recovery codes?
In Bitwarden, open the web vault, go to Account Settings, then Two-step Login, and view your recovery code. Google accounts have backup codes under Security, then 2-Step Verification. Every major provider has them somewhere: find yours now, before you need them.
Do I need an emergency sheet for KeePass or a self-hosted vault?
Even more so. With a self-hosted or offline vault there is no company to email for recovery. The database file plus the master password is the entire account, so both need a backup plan.
How often should I update the sheet?
Whenever the master password, 2FA, or export password changes, plus a yearly check that everything on it is still current. A stale sheet is worse than no sheet in one specific way: it gives you confidence right up until the moment it fails.