In the dashboard, these operations are delegated to the CLI. The profile detail page surfaces a Key management section, but each action points you to the CLI, where the local daemon holds the root key. The dashboard does not perform password changes, recovery-key generation, or key rotation in the browser.
Where to perform each operation
The dashboard’s Key management section on a zero-knowledge profile lists these actions; selecting one shows a prompt telling you to run the corresponding CLI command.
What the operations do
These run client-side (CLI + daemon); the server only sees the new wrapped material.Change profile password
Re-wraps the existing root key under a new KEK derived from the new password. The root key itself is unchanged, so every existing item remains decryptable and any existing recovery key still works.Recovery key
Without recovery, losing the profile password means losing every item in a zero-knowledge profile. A recovery key adds a second wrap of the root key under a separate 256-bit key. Store it offline — abadge does not retain the value, and there is no server-side recovery.Rotate root key
Generates a fresh 32-byte root key, re-wraps every item DEK with it, and re-wraps the new root key under the current KEK (and the recovery key, if set). The plaintext payload of every item is unchanged — only the wrap changes. The server applies all updates in one transaction and incrementskeyVersion. If the client misses any items, the server returns ROTATE_KEY_INCOMPLETE with the missing IDs in meta.missingItemIds.
Server-managed profiles
Server-managed profiles do not expose vault security operations — there is no profile password and no client-side root key. Rotating the Worker’sENCRYPTION_KEY is an operational task handled outside the dashboard.