Dai Vernon Teams — FAQ

Longer is better. A passphrase of 4–5 unrelated words is stronger than a short complex password. Avoid phrases from songs, books, movies, or personal information. The strength indicator in the app must reach at least Good before the app will accept your passphrase.

Your data cannot be recovered. DVT uses zero-persistence architecture — your passphrase is the only key. There is no server-side recovery, no password reset email, and no backdoor. Choose a passphrase you will remember, and consider writing it down and storing it securely offline (not on your computer).

Yes, from Settings → Security → Update Passphrase. However, read the note below before doing so.

The master passphrase you use when joining a team is permanently linked to your access to that team vault. If you change your master passphrase after joining, you will need to use your original passphrase to unlock the team vault. This is a deliberate architectural behavior, not a bug. Plan your passphrase carefully before joining teams.

Your email address is used as your identity across teams and devices — it is how administrators identify you and how your device is registered. It is stored locally on your machine only and is never transmitted to any server in plaintext.

This is worth considering carefully. Your email address is stored in your local vault metadata. While it is encrypted at rest, it is an identifier that could confirm your identity if your device were ever compromised. Even in isolation, a confirmed email address is useful to a bad actor — it can confirm you are a target worth pursuing.

Security-conscious users may prefer to use a dedicated alias rather than their primary personal or work email. Enterprise users should follow their organization's security policy on this point.

A second passphrase that all team members share. It is set by the administrator when creating the team and must be shared with members privately, out-of-band. It is never sent to the server. Think of it as the combination to the team's shared safe — every member needs it, but it never leaves the team through any digital channel. The term stems from the mystery riddle about the man arrested for bringing building supplies to his truck everyday. He used a wheelbarrow to get them from the store to the truck. In the app, the wheelbarrow is the device you use to bring your current passwords to you from the company list.

The relay server facilitates encrypted synchronization between team members. It handles only encrypted data — it never sees your passwords or passphrases. Your data stays encrypted from your device to your teammates' devices. The relay connection is automatic — there is nothing for users to configure.

The administrator creates the team, invites members, manages roles, and can remove members. A team can have multiple administrators. If there is only one administrator and they lose access to their vault, the team vault cannot be recovered — this is by design. Having a second administrator is strongly recommended for any business-critical team.

Only when you cannot recover access any other way — for example, a forgotten master passphrase that cannot be rebuilt. Reset Vault permanently deletes all local vault data and cannot be undone.

All local vault data including your encrypted chain files, personal vault, team vault data, device identity, and app preferences. After reset, DVT launches fresh as if newly installed.

Your team vault is unaffected. Other members continue normally. You will need to re-join the team after resetting — contact your administrator for a new invite.

If you are the only administrator on a team, your team members will receive a notification on their next sync that the team has been dissolved. They will need to reset their local vaults and re-join once the team is recreated.

If your team has more than one administrator, another admin can remove you from the team (or reduce your status to Member) before you reset and the team continues without interruption.

Settings → Security → Reset Vault. Two confirmations are required before any data is deleted.