Recovery

If you've lost your password or your authenticator, make a recovery link on the server. On a Linux server installed with install.sh, run this command.

sudo -u nifty sh -c 'set -a; . /etc/nifty.env; NIFTY_DATA=/var/lib/nifty /usr/local/bin/nifty recovery-url'

It prints a link. Then follow these steps.

1. Open the link within 15 minutes, in the browser you want to use.
2. Type a New password of at least 8 characters, and type it again in Confirm new password.
3. Choose Set password and sign in.

What to know

• The link works once. Making a new link cancels any earlier unused link.
• Setting the password signs you out on every other device. Sign in again there with the new password.
• Setting the password also turns off two-factor authentication. Every authenticator is removed, and no browser skips the code any more. Add your authenticators again in Settings → Two-factor authentication.
• API tokens keep working. Revoke any you don't trust in Settings → API tokens.
• Only someone who can run commands on the server can make a link, so recovery adds no new way in.

Why the long command

nifty recovery-url must use the server's data folder and address, and write as the server's user. The command runs it as nifty, with the settings from /etc/nifty.env. If you started Nifty another way, pass the same --data and --origin that nifty run uses.

nifty recovery-url --data /path/to/data --origin https://notes.example.com

The command runs beside the server, so you don't need to stop the server. If --data names a folder without Nifty's database in it, the command stops with an error naming that folder, rather than making a new, empty one. If you've updated Nifty but haven't restarted the server, the command asks you to restart it first.

If the link doesn't work

An expired or used link says so and shows the command again, so make a new link. Before the first-run setup, there's nothing to recover, so open Nifty and set it up.

After changing the secret key

Authenticators are locked with the server's secret key, which is secret.key in the data folder or NIFTY_SECRET_KEY. If the key is lost or changed, no code works. Make a recovery link, and then add your authenticators again.

Data from the Mac app

The Mac app doesn't need a password, so data moved from it to a server may not have one. Make a recovery link to set a password.

When the Mac app keeps your data on your Mac, it signs you in by itself, so it never needs recovery. See Signing in and recovery.