# Mission 7 — Backup, Recover, and Ensure Separate Permission Keys

> Learn how to recover a lost Vaulta private key using a key certificate, protect your owner permission with a separate keypair, and verify that your recovery process actually works.

Canonical: https://help.blockzhub.io/articles/mission-7-backup-recover-and-ensure-separate-permission-keys

What happens if your computer breaks, your Blocksfinity Authenticator disappears, you forget your master password, or you somehow lose your original private key?

If you prepared a key certificate, you can recover the original private key in a new vault on your Authenticator app. This works also on a new device. The certificate contains an encrypted version of your private key. To unlock it, you also need the six encryption words you wrote down when creating it.

In this mission, we will back up and restore our active key, check whether our owner and active permissions use different keypairs, if not change the keypair for the owner permission, and secure our owner permission with an independently protected key certificate backup.

By the end, you should understand not only how to recover your keys, but also why separating everyday signing authority from account recovery authority is so important.

## Your private keys, your vault, and your blockchain account

Remember [Chapter 4 — Your Vaulta Account: Identity, Keys and Permissions](https://help.blockzhub.io/articles/chapter-4-your-vaulta-account-identity-keys-and-permissions)?

Your Vaulta account exists on the blockchain. It does not live inside Blocksfinity Authenticator.

The Authenticator stores your private keys in an encrypted local vault. Those keys allow you to authorize actions according to the permissions configured on your blockchain account.

Two permissions are especially important:

- owner — The highest standard account authority. It can change the keys and permissions controlling your account. It should be protected carefully and used rarely.

- active — Used for everyday activities such as transferring tokens, staking, voting, and interacting with smart contracts.

Ideally, these permissions use different keypairs.

Think of the configuration we want to achieve:

Your Vaulta account
│
├── owner permission
│     └── Separate owner public key A
│           └── Owner private key A
│                 → Protected offline
│                 → Recovery certificate
│
└── active permission
      └── Separate active public key B
            └── Active private key B
                  → Blocksfinity Authenticator (daily use)
                  → Recovery certificateWhy?

Imagine somebody steals your everyday active private key.

That is already serious. But if your owner key is separate and remains protected, you can use it to replace the compromised active key and regain exclusive control.

If both permissions use the same private key, stealing that one key potentially gives the attacker both levels of authority.

Key idea: A key certificate protects your ability to recover a private key. Separate owner and active keypairs protect your ability to recover control when an everyday key is compromised.

## Part 1 — Back up your active key with a key certificate

[Since you already imported your active key into the Blocksfinity Authenticator app](https://help.blockzhub.io/articles/how-to-import-a-private-key-into-the-blocksfinity-authenticator-app), we will first create a recovery certificate for the private key associated with your active permission.

The certificate provides an additional recovery path if the original private key got lost due to some circumstances.

### Step 1 — Start the key certificate backup process

Open the Blocksfinity Authenticator app.

Under Accounts, locate your Vaulta account.

If a key does not have a recovery certificate yet, the Authenticator may display a warning such as:

“key has no certificate”

Click Backup now, or open the account and find the corresponding key under Permissions & keys. In this example we create a backup key certificate for the Vaulta account supportacc1h, active permission supportacc1h@active:

Open the account's key details and click Owner key certificate for the key you want to back up:

### Step 2 — Confirm your identity

The Authenticator asks you to re-enter your master password.

This confirms that you are authorized to access the private key stored in the vault.

Enter the password and click Confirm.

### Step 3 — Save the certificate (PDF) and the six encryption words

The Authenticator displays six encryption words.

These words are necessary to decrypt the private key stored in the certificate.

- Write all six words down by hand, in the correct order.

- Double-check their spelling.

- Click Download certificate PDF.

- Save the certificate securely.

- Confirm that you wrote the words down.

The PDF contains the encrypted recovery information, including a QR code and a printable encrypted mnemonic.

The PDF alone is not enough to restore your private key. You also need the six encryption words. If you print the certificate, you'll find a dedicated space at the bottom where you can write those six words directly on the paper.

Important: If you write the six words on the printed certificate, anyone who obtains that document could recover your private key. Store it securely. For greater security, keep the certificate and the six encryption words in separate, secure locations.

Avoid screenshots, cloud-synced notes, online documents, and synced clipboards. Prefer keeping the certificate and handwritten encryption words separately in secure locations, offline, not accessible from the internet.

You may also maintain additional properly secured paper copies so that a single damaged offline sheet or lost storage device (USB drive for example) does not destroy your recovery path.

### Step 4 — Prove that you wrote the words correctly

The Authenticator does something important before accepting your backup confirmation.

It hides the encryption words and asks you to enter three of them again.

Read those words from the paper on which you actually wrote them, not from memory.

This checks that you recorded the correct words and their order.

Enter the requested words and click Confirm backup.

The Authenticator should now confirm that the backup is complete.

Your key is now marked as recoverable through its certificate.

Important: Recovery still depends on preserving both the encrypted certificate data and the correct six encryption words. Anyone who obtains both may be able to reconstruct your private key.

## Part 2 — Simulate losing your Authenticator vault

Now we will deliberately simulate losing access to the local vault.

This demonstrates something fundamental: losing your Authenticator vault does not delete your Vaulta blockchain account.

Only the locally stored keys are affected.

You can also perform this exercise on a second device without erasing your existing vault.

Important: Do not erase your vault unless you have independently secured the private keys or verified recovery certificates for every key you need to keep. This exercise is best performed with a training account or an account holding no material assets. Erasing the vault cannot be undone.

### Step 5 — Open the vault security settings

In Blocksfinity Authenticator, go to:

Settings → Danger zone → Erase vault

### Step 6 — Erase the local vault

The Authenticator displays a warning explaining that the local vault and its keys will be removed.

It may also show which keys have confirmed recovery certificates.

Type:

ERASE

Then click Erase vault.

The local vault is deleted.

Your Vaulta account, tokens, resources, transaction history, and on-chain permissions remain unchanged.

We have removed a local way of accessing the account, not the account itself.

## Part 3 — Recover your active key from the certificate

Now imagine you are using a new computer or have just reinstalled Blocksfinity Authenticator.

You no longer have the original vault and lets say you also lost your private key somehow, so importing a private key will not work in this case.

But you still have your key certificate PDF and the six handwritten encryption words.

That is all the recovery information this certificate workflow requires.

### Step 7 — Create a new Authenticator vault

Open Blocksfinity Authenticator.

Create a new vault and choose a strong master password of at least 16 characters.

Record the master password securely.

This is a new local vault to restore your access credentials to your Vaulta account. You are not creating another Vaulta blockchain account.

### Step 8 — Choose recovery from a key certificate

In the Authenticator, open:

Add → Recover from key certificate

You can recover using the QR code or the printed recovery information from the PDF.

For this exercise, choose Printed words, so you understand what information is actually required.

### Step 9 — Enter the recovery information

Enter the following details:

- Account name: Your existing Vaulta account name. In this example we use supportacc1h. Enter the name of your Vaulta account.

- Permission: active

- Network: Vaulta

- Encrypted mnemonic: The encrypted recovery information printed in the certificate PDF. The 28 words.

Enter the 28 words with a space between each word:

“word1 word2 word3 … word27 word28”

- 6 encryption words: The six words you wrote down by hand.

Both parts are required.

Click Recover key.

### Step 10 — Verify that your active key was restored

If the information is correct, Blocksfinity Authenticator confirms that the key has been restored.

Open the account and check the recovered public key.

It should match the original public key associated with your active permission.

When connected to Vaulta, you can also verify that the key is still authorized on-chain and test a normal Authenticator login and a test transaction.

You have now recovered the original private key without needing the original vault, its master password, or a separately saved copy of that private key.

Notice what did not happen:

- No new Vaulta account was created.

- No blockchain permission was changed.

- No transaction was required merely to reconstruct the private key.

This was a local recovery operation.

## Part 4 — Make sure owner and active use separate keypairs

Now we move to a different kind of security.

Our recovery certificate protects us against losing a key.

But what if the same private key controls both our owner and active permissions?

Then the separation between everyday access and higher-level recovery authority is missing.

We should check that.

### Step 11 — Compare your owner and active public keys

Open [Blocksfinity — Account](https://www.blocksfinity.com/account) and find your account.

Scroll to Chain Data → Keys.

You should see the public keys associated with your owner and active permissions.

Compare them carefully.

In our example, both permissions initially use the same public key.

That means the same private key can satisfy both permissions.

If your owner and active permissions already use different, independently protected keypairs, you do not need to rotate your owner key for this exercise. Keep that separation and proceed to Part 5 to back up and test your existing owner key.

If the keys are identical, continue with the following steps.

Important: The following Simple-view procedure assumes a normal account configuration with one key and a threshold of one for the owner permission. If your account uses multiple keys, other account authorities, or higher thresholds, do not replace the configuration with a single key. Review the Advanced permission structure first.

### Step 12 — Import your existing owner key into the Authenticator app

To change the owner permission keypair, we first need to authorize the change using the current owner authority.

If the current owner key is not already available in your Blocksfinity Authenticator app, import it.

Follow [How to Import a Private Key into the Blocksfinity Authenticator App](https://help.blockzhub.io/articles/how-to-import-a-private-key-into-the-blocksfinity-authenticator-app), Steps 4–7.

This time, use your existing owner private key and owner permission.

If the app finds more than one account or permission, in you case it may find YOURACC@owner and YOURACC@active, select YOURACC@owner and add the owner keypair to your authenticator app.

### Step 13 — Log in using owner permission

Go to [Blocksfinity — Keys & Permissions](https://www.blocksfinity.com/wallet/permissions).

Log in with Blocksfinity Authenticator.

Choose Open Blocksfinity Authenticator app when prompted.

The Authenticator displays a login approval request.

Under Sign as, select your account with:

@owner

Then click Approve login.

Back in Blocksfinity, verify that you are logged in with the owner permission.

We will use this authority to approve a change to the account's on-chain owner key.

### Step 14 — Generate a new owner keypair

We need a new public/private keypair.

The public key will become the new on-chain owner authority. The private key must remain securely under your control.

To minimize the risk of exposing your private key, we will generate the new keypair while disconnected from the internet.

Your owner key provides the highest level of control over your Vaulta account, so it should ideally be kept offline and exposed to internet-connected devices as little as possible.

For a refresher on why this matters, revisit [Chapter 5 — What Is a Wallet and an Authenticator? Hot vs. Cold](https://help.blockzhub.io/articles/chapter-5-what-is-a-wallet-and-an-authenticator-hot-vs-cold).

### Generate your Vaulta owner keypair offline

- Open [Blocksfinity – Keys & Permissions](https://www.blocksfinity.com/wallet/permissions) in a new Incognito/InPrivate browser window. Make sure no extensions are enabled in private browsing.

- Wait for the website to load completely.

- Disconnect from the internet and enable airplane mode. Make sure Wi-Fi, Ethernet, and mobile data connections are disabled.

- Generate your new Vaulta keypair.

- Securely back up your private key offline. Write it down, verify every character, and save the corresponding public key. Avoid screenshots, cloud-synced notes, and synced clipboards.

- Close all Incognito/InPrivate windows while still offline.

- Only then restore your internet connection.

### Why use Incognito mode and close the browser before reconnecting?

With Blocksfinity private keys are generated locally in your browser using cryptographically secure randomness. They are not transmitted to a server or saved in browser storage.

Using Incognito/InPrivate mode adds another layer of precaution by limiting retained browsing data. Closing all private browsing windows ends the private session and clears its temporary site data.

Closing the session while still offline also ensures the key-generation page is no longer running when internet connectivity is restored.

These precautions reduce potential exposure but do not replace the need to trust the website's code and the security of your device.

Important: Incognito mode is not a security boundary against malicious website code, malware, keyloggers, or a compromised operating system. For especially valuable owner authority, a dedicated offline device, an offline key generator tool or hardware signing solution can provide stronger isolation.

### Step 15 — Assign the new public key to owner

You now have:

- A new owner private key, securely backed up offline.

- Its corresponding new owner public key, which we can safely use in the permission update.

Reconnect to the internet and reopen [Blocksfinity — Keys & Permissions](https://www.blocksfinity.com/wallet/permissions).

Log in again with your existing owner authority if necessary.

In this step by step article we will use the Simple tab, which will rotate the key in one step (Add the new keypair and remove the old keypair).

### Alternative: Add the new owner keypair before removing the old one

If you have time and the owner key doesn’t have to be changed “fast”, a safer approach is to use the Advanced tab and change your owner key in two stages:

- Add your new owner public key as a second authorized key, while keeping the existing owner keypair. Ensure the permission threshold (1) and key weights (each keypair should have 1) allow either key to authorize independently.

- Test the new key by importing its private key into a new Blocksfinity Authenticator app (use another device to test) and logging in with owner permission. Ideally, also verify that it can successfully authorize an owner-level blockchain transaction (for example transfer 0.0001 $A), since logging in alone is not a complete test.

- Remove the old owner public key from the owner permission only after confirming that the new keypair works. Verify the final permission configuration on-chain.

This approach reduces the risk of accidentally locking yourself out because you keep your existing owner authority until the new one has been tested.

Important: If your old owner keypair also controls your active permission, it must remain backed up in case you need to re-import the keypair again.

Select the Simple tab.

Under New owner key, click:

Use my own key instead

Enter the new owner public key that you saved during offline generation.

Do not enter the private key here.

Leave New active key empty so the existing active permission remains unchanged.

Check every character of the new owner public key.

This is critical: if you assign an incorrect public key and no other authorized recovery path remains, you may permanently lose control of your owner permission.

When everything is correct, click Change permission.

### Step 16 — Confirm the owner permission update

Blocksfinity displays a security warning:

Update permissions?

This is not an ordinary login or local wallet setting.

You are about to authorize an on-chain transaction that changes which cryptographic credential controls your account.

Click Update keys only after confirming your new private key has been backed up and matches the public key you entered.

### Step 17 — Review and sign the blockchain transaction

Choose Open Blocksfinity Authenticator app.

The Authenticator displays the transaction requiring your signature.

Look for the permission-changing action:

eosio::updateauth

This is the blockchain system action that updates account authority.

Review the displayed details:

Account:       Your Vaulta account
Permission:    owner
Parent:        empty
Threshold:     1
Keys:          1
Public key:    Your NEW owner public key
Key weight:    1
Authorized by: ownerFor this simple one-key setup, the new owner public key must be exactly the one you generated offline.

The request may contain additional actions. Review the entire transaction, not just the permission update.

Checkpoint: Confirm that the action is changing the owner permission for your own account, using the correct new public key and intended authority configuration. Do not sign if you are not sure it everything is correct and you have the private key associated with your new public key.

Click Sign.

Your existing owner authority has now authorized replacing its own on-chain key.

The new owner private key did not authorize this change. The previous owner key did.

### Step 18 — Verify the result on Vaulta

Return to [Blocksfinity — Account](https://www.blocksfinity.com/account).

Under Chain Data → Keys, confirm:

- owner now displays your new owner public key.

- active still displays your original active public key.

- The two public keys are now different.

This is the on-chain evidence that your owner-key rotation succeeded.

You can also inspect the permission-update transaction in the Explorer transaction history. Click [https://www.blocksfinity.com/account](https://www.blocksfinity.com/account) and scroll down to “Transactions“ to investigate.

Your account name, assets, balances, etc. have not changed.

Only the authority controlling owner has changed.

Important: If your original owner and active permissions shared one keypair, the old owner private key is still your valid active private key after this update. Do not delete it from Authenticator merely because it is no longer the owner key. Remove an obsolete owner association only if the app supports doing so without deleting the active key. We will clean up the temporary owner-key exposure in Part 5.

## Part 5 — Create and test a certificate for your owner key

Now we made sure that we have a secure permission structure with 2 different key pairs.

Our everyday active key can remain available in Blocksfinity Authenticator.

Our new owner private key should be treated differently.

Ideally, it should spend as little time as possible on an internet-connected device.

But before removing it from the Authenticator, we want an additional tested recovery mechanism.

We will create a key certificate for the new owner key, restore it offline, and then return to an active-only everyday vault.

If you skipped owner rotation because your keys were already separate, use your existing owner private key for the following certificate procedure.

### Step 19 — Import your new owner private key

Because your owner private key provides the highest level of control over your Vaulta account, we want to minimize its exposure to internet-connected devices. Before importing the key into Blocksfinity Authenticator, disconnect from the internet again.

Open Blocksfinity Authenticator.

Choose:

Add → Import private key

Enter your new owner private key into the installed Authenticator.

The application normally attempts to identify the account and permission associated with the public key by checking Vaulta. When the computer is offline, it will tell you that it can’t find or link the acocunt (No accounts found yet):

Insert your account name. In this example we use supportacc1h

Select the correct owner permission.

Click Link account

Then it will show you another information that it couldn’t check on-chain (online):

Click Link without checking.

Sidenote: Never paste the owner private key into the Blocksfinity Explorer's public-key field or an unfamiliar website. Import private keys only through the trusted Authenticator application.

After we imported the owner private key, we can now continue with the certificate creation and recovery test. Continue in “offline mode” to reduce exposure.

### Step 20 — Create the owner key certificate offline

Open your account in Blocksfinity Authenticator.

Under Permissions & keys, select the newly imported owner key.

Click Owner key certificate.

Repeat the procedure from Part 1:

- Confirm using your Authenticator master password.

- Write down the six encryption words.

- Download the certificate PDF.

- Securely store both recovery components.

- Complete the word-verification challenge.

- Confirm the backup.

This time the certificate protects your new owner private key, not the active key.

Keep the owner certificate and encryption words especially secure. A person who obtains both may be able to reconstruct the highest-authority private key for your account.

### Step 21 — Test owner recovery while offline

We want to know whether we can really reconstruct the owner private key from the certificate.

While still offline:

- Make sure the certificate PDF and six encryption words are safely available.

- Erase the current Authenticator vault.

- Create a new vault with a new master password.

- Select Add → Recover from key certificate.

- Select Printed words.

- Enter your account name.

- Choose permission owner.

- Select network Vaulta.

- Enter the encrypted mnemonic from the certificate.

- Enter your six handwritten encryption words.

- Click Recover key.

This is the same recovery process we used earlier with the active key.

The important difference is the selected permission and certificate.

### Step 22 — Verify the recovered owner public key

Because you are offline, the Authenticator may not be able to check the blockchain.

You might see a message such as:

Not on the account yet

Do not assume this means the key has been removed from your blockchain account.

An offline device cannot reliably establish current on-chain authority.

Instead, open the recovered key details in the Authenticator.

Find the public key derived from your restored owner private key.

Compare that public key against the new owner public key you previously verified on-chain under:

[Blocksfinity — Account](https://www.blocksfinity.com/account) → Chain Data → Keys

You should have saved that public key before going offline or you can check it on another device which is online and connected to the internet.

If both public keys match exactly, you have verified that the certificate restores the intended owner keypair.

Remember the distinction:

- Offline recovery test: Verifies that you reconstructed the expected private key and public key.

- On-chain verification: Confirms which public key currently controls the account permission.

A matching offline public key and a previously verified on-chain owner public key are strong evidence that the recovery information is correct. They do not replace a live blockchain check if permissions have subsequently changed.

Checkpoint: Do not discard the original owner private-key backup until you have successfully tested certificate recovery and verified that the recovered public key matches the intended on-chain owner key.

### Step 23 — Remove the owner key from your everyday vault

Now we want to return to a safer day-to-day configuration.

Your owner key should not need to remain imported in the same Authenticator vault used for ordinary transactions.

While still offline:

- Confirm that your owner private key and certificate backups are secure.

- Remove the owner permission or erase the temporary Authenticator vault containing the restored owner key.

Under accounts you can remove a particular keypair for a permission of an account:

Or you can erase the whole vault again under Settings → Danger Zone → Erase Vaulta. Erasing the vault removes all the imported/added keys managed by that local vault.

- Close the Authenticator.

### Step 24 — Restore only your active key for everyday use

Reconnect to the internet when ready.

If you erased the whole vault, create a new Blocksfinity Authenticator vault otherwise skip this step.

Then add only your existing active key using either:

- Import private key, if you still have the original active private key; or

- Recover from key certificate, using the active certificate and six encryption words created in Part 1.

Verify that the imported active public key matches your account's current active permission.

Your normal Authenticator vault should now contain your everyday active credential, while your owner private key remains independently protected offline.

The result is:

Vaulta account
│
├── OWNER
│     ├── Separate owner keypair generated offline
│     ├── Private key protected offline
│     ├── Owner recovery certificate tested offline
│     └── Not retained in everyday vault
│
└── ACTIVE
      ├── Separate active keypair
      ├── Private key in Authenticator
      └── Tested active recovery certificateYou now have two different forms of protection:

Recoverability: A prepared certificate can restore a lost private key.

Permission separation: A compromise of the everyday active key does not automatically expose the separately protected owner private key.

## What just happened?

In this mission, we did more than create backup files.

- We created an encrypted certificate for an existing active private key and verified that we had recorded its six encryption words correctly.

- We erased a local Authenticator vault and restored the same active key in a new vault without modifying the blockchain account.

- We compared the public keys controlling owner and active and, where necessary, generated a separate owner keypair.

- We used the existing owner authority to sign an eosio::updateauth transaction. Vaulta then updated the on-chain owner permission.

- We created and tested a recovery certificate for the owner key, compared the recovered public key against the expected on-chain public key, and removed the owner key from our everyday Authenticator vault.

- We practiced key generation and tested the restore procudure in offline mode for the owner permission to reduce online exposure for the most important private key.

The difference between these actions matters.

Creating, encrypting, backing up, and restoring a private key are local operations.

Changing the public key assigned to a Vaulta permission is an on-chain operation requiring a properly authorized transaction.

That separation between local credentials and on-chain authority is one of the most important concepts in self-custody.

## What you should remember

- Your Vaulta account does not disappear when you lose your Authenticator vault or device.

- A key certificate can restore the original private key if you somehow lost it and you retain the encrypted certificate and its six encryption words.

- The owner and active permissions should use separate, independently protected keypairs. Your owner private key requires extra protection because it provides the highest level of control over your Vaulta account. Ideally, keep it securely stored offline and minimize its exposure to internet-connected devices as much as possible.

- Changing a permission requires an authorized on-chain transaction; restoring a key does not.

- Keep the owner key offline where practical, verify your recovery material, and use the active key for normal activity.

- A backup is substantially more useful when you have actually tested that you can recover from it.

In [Mission 8 — Permissions, Passkeys and the Web Authenticator](https://help.blockzhub.io/articles/mission-8-permissions-passkeys-and-the-web-authenticator), we will build on this foundation by examining additional credentials, including passkeys, that can authorize everyday account operations.

## Quick Quiz

### 1. What is required to recover a private key using the key certificate created in this mission?

- A. Only the Vaulta account name

- B. The encrypted certificate information and the correct six encryption words

- C. The original Authenticator master password

- D. Approval from Blocksfinity support

### 2. What happens to your Vaulta account when you erase your local Authenticator vault?

- A. The blockchain account is deleted

- B. All account permissions are reset

- C. The local keys are removed, but the blockchain account remains unchanged

- D. The blockchain automatically creates new owner and active keys

### 3. Why is using the same keypair for owner and active a security problem?

- A. Compromising the shared private key can give an attacker both levels of authority

- B. Vaulta cannot process transactions when the keys match

- C. An account must pay twice as much CPU when using the same key

- D. Recovery certificates cannot be created for shared keypairs

### 4. Which authority signs the transaction that replaces your current owner public key?

- A. The new owner private key before it has been assigned on-chain

- B. Any public key that belongs to another Vaulta account

- C. Blocksfinity's support account

- D. The existing owner authority

### 5. You recover your owner key while completely offline, but the Authenticator says "Not on the account yet." What can you conclude?

- A. Your owner private key has definitely been removed from Vaulta

- B. You must generate a completely new blockchain account

- C. The offline result does not establish current blockchain authority; compare the recovered public key with your previously verified owner public key on-chain

- D. Your six encryption words must be incorrect

##

Answer footnote: Q1:2; Q2:3; Q3:1; Q4:4; Q5:3.