The recovery password is your Session identity: protect it accordingly

What recovery actually restores

The recovery password regenerates account keys and restores the same Account ID. Official guidance explains that a restored client may retrieve messages and configuration data that remain within the network’s retention periods. It is not an unlimited cloud backup and should not be expected to recreate every local conversation. Think of it as an identity credential rather than an archive of your chat history.

Use two independent storage methods

A sensible baseline is two handwritten copies in separate controlled places. A reputable password manager is another option when protected by device encryption and a strong master password. Do not store the phrase beside a QR code, display name, or device unlock code; combining those items turns one loss into a complete account compromise.

Respond decisively to suspected exposure

If the phrase appeared on an untrusted device, in a public screenshot, or in a shared document, assume the identity may be compromised. A Session recovery phrase cannot be rotated like an ordinary website password. The safer response is often to create a new Account ID, notify contacts through a verified channel, and retire the old identity in an orderly way.