Click “forgot my password” in most apps and a reset link arrives by email, you type a new password, and your data is still sitting there. The flow is so familiar that it never reads as a statement about anything. It is one: if a server can re-associate your data with a new password, that server is in a position to read the data.
The key comes out of the password itself
Under end-to-end encryption the key that opens your content does not sit on the server; the key is derived from your password by a key derivation function, the derivation happens on your own device, and the only thing that travels to the server is encrypted blocks. The key never leaves.
The consequence is direct. Change the password and the derived key changes with it, the blocks on the server stay encrypted under the old key, and the new key will not open them. The server cannot help. If it could, a copy of the key would already be sitting there, and by the end of that sentence there would be nothing left of the phrase end-to-end.
A recovery key fills that gap
This is why serious systems generate a recovery key or recovery phrase during setup: a long, randomly chosen, unguessable string whose only job is to hold a second copy of the real encryption key, locked under that string. Call it a spare key.
When you forget the password, that phrase reopens the real key, you set a new password, and the key goes back behind a lock derived from it. The data is never decrypted. The server never sees the content at any stage.
There is a cost, and honestly it falls entirely on your side: lose the phrase and the second door closes too. That is why a recovery phrase does not go into the vault; putting the thing that opens the vault inside the vault produces a circle.
Three different models all called “recoverable”
Products use the same word for different things, and the difference changes the whole security model.
Key escrow. The provider keeps a copy of the key. Password reset works smoothly, and in exchange the provider is able to open the content under a court order or after a breach.
Social recovery. The key is mathematically split into shares handed to people you trust, and once a predetermined number of shares come together the key is rebuilt. Common in crypto wallets. Rare in note apps.
Recovery key only. The single copy is yours. The strongest model, and the least forgiving.
The way to find out which one an app implements is not the marketing page. It is the security document and the “forgot my password” entry in the help centre.
Where Context sits
API keys and passwords go into the vault, recovery phrases do not, and that split is deliberate. End-to-end encryption is not finished for every scenario and no independent security audit has been done; both sentences are written on the security page, and we are not acting as though they say otherwise.
The most useful thing you can do today is product independent, though. Write your recovery phrase on paper, take no screenshot, keep it out of cloud notes. Then test it once: sign out, and sign back in with the phrase. An untested recovery path does not count as a plan.