# pass.new recovery kit

**Get your password back from its blocks, even if pass.new no longer exists.**

[pass.new](https://pass.new) can split a password (for example a Bitcoin private key or a seed phrase) into **5 printed blocks**. **Any 3 blocks** rebuild the password exactly; 1 or 2 blocks reveal nothing at all.

This kit contains everything needed to do that without pass.new. It's public domain: copy it, print it, keep it with your blocks, and share it freely.

The latest copy always lives at **https://github.com/pass-new/recovery-kit** and at **https://pass.new/recovery-kit/**.

## What's in the kit

| File | What it's for |
| --- | --- |
| `recover.html` | Offline recovery page. Open it in any web browser, even with the internet off, and type in 3 blocks. |
| `recover.py` | The same thing as a short Python 3 program with no installs needed: `python3 recover.py` |
| `AI-PROMPT.txt` | A ready-made prompt that lets an AI assistant rebuild the password from 3 blocks. Read the warning at the top first. |
| `test-blocks.txt` | Example blocks with a known password, to check a tool works before you use real blocks. |
| `pass-new-recovery-guide.pdf` | The guide, the AI prompt and the program, printable, to keep on paper with your blocks. |

## How to get a password back

1. Collect **any 3 blocks from the same set**. The Set ID printed on each block must match.
2. Use whichever of these is easiest:
   - **pass.new/split**: scan the QR codes with a phone camera, or type the blocks in.
   - **recover.html**: open it in a browser and type in 3 blocks.
   - **recover.py**: run `python3 recover.py` and paste in 3 blocks when asked.
   - **An AI assistant**: follow `AI-PROMPT.txt`. For anything valuable, prefer the offline options, and move funds or change the password afterwards.
3. Type blocks exactly as printed. Capitals, spaces and dashes don't matter, and `O`/`0` and `I`/`L`/`1` are treated the same.

## The block format (version 1)

Anyone can write their own recovery program from this description alone.

- **Block text:** Crockford Base32, alphabet `0123456789ABCDEFGHJKMNPQRSTVWXYZ`. Read 5 bits per character, most significant bit first, and drop leftover bits at the end.
- **Block bytes:** `[version = 1] [0x35 = any 3 of 5] [block number x = 1..5] [4-byte set ID] [block data] [4-byte checksum]`. The checksum is the first 4 bytes of SHA-256 of everything before it.
- **Combining:** Shamir's method over GF(256) with the AES polynomial `0x11B`. For each byte position, `result = XOR over blocks i of y_i * L_i`, where `L_i = product over j != i of x_j / (x_j XOR x_i)`.
- **Result:** `[2-byte big-endian length n] [n bytes of UTF-8 password] [first 4 bytes of SHA-256(password)] [zero padding]`. Padding is to a multiple of 16 bytes, minimum 48. Recovery succeeds only if the 4 fingerprint bytes match, so the result is always either byte-for-byte exact or an error.

## Good to know

- Anyone holding 3 blocks can rebuild the password. Give blocks to different people, who ideally don't all know each other.
- Two blocks reveal nothing about the password. That's a mathematical property of the method, not a promise.
- Everything in this kit runs on your own device and never contacts the internet.