The recovery kit is what gets you back in
Day to day you sign in with your personal 6-digit PIN, on any device where your family is set up. Behind that sits one family-wide way back in: your recovery kit — a generated code you can save as a printable PDF with a QR code. If every device and every PIN were ever lost, the kit is the only way back into your family’s data.
The kit is created when your family is created. The family owner or a pod manager can also create a new one any time in Settings → Security & Recovery (a kit can reset every PIN, so other members cannot). Every kit has a short kit ID printed on it, and Manage Kits lists every kit your family has ever made by that ID: live kits show who created them and when, and invalidated kits show when and by whom they were invalidated.
Creating a new kit does not switch off an old one. If a kit is lost, photographed, or you simply no longer trust it, the family owner or a pod manager can invalidate it from Manage Kits. An invalidated kit stops opening your family’s data on every device as soon as they sync, and stays listed as invalidated so an old printout can be recognised. This cannot be undone. Your only remaining kit can be replaced but never removed outright: a new kit is created and saved first, and the old one is invalidated only once the new one is safely on file.
Invalidating a kit protects your family file from now on. A copy of the file saved before the invalidation can still be opened with the old kit, because the file itself is not re-encrypted. Destroy any printout you no longer trust.
Keep the kit somewhere other than the Google Drive that holds your family’s data — print it and put it with your important documents, save it in a password manager, or keep it in a different cloud account. If the kit sits right next to the file it unlocks, losing one account exposes both.
The family passphrase (optional)
If you’d rather remember something than store something, you can also set a family passphrase in Settings → Security & Recovery — a memorable phrase that can open your family’s data on a fresh device, just like the kit. It’s optional, and it works alongside the kit rather than replacing it.
The suggested phrase is six words from a large public list, and a phrase you type yourself is checked for strength as you type. If your family passphrase came from the older, shorter suggestion, Settings will gently flag it so you can choose a new one when you have a minute. It stays optional, and it always sits alongside your recovery kit.
Forgot your PIN?
A forgotten PIN is not an emergency. You have two easy ways back in:
- Ask another parent — any pod manager can reset your PIN from your bean page, right in the app. (This is also how parents set or reset a child’s PIN.)
- Use your recovery kit — it unlocks your family’s data on the device and then offers to set you a new PIN. (Using the kit does not replace your PIN by itself: if you remember it after all, just sign in with it. The kit is the only thing that can reset a PIN, which is why the option appears there and nowhere else.)
- Or your family passphrase — it unlocks your family’s data the same way, but it cannot reset a PIN.
Signing in on a new device
Most of the time you will not need the kit for this at all — use your beanies magic link, the personal link you were given when you created or joined your family. Open it on the new device and you go straight to your PIN. The kit is for when that is gone too.
On a device that’s already signed in, open Settings → Security & Recovery and tap Link a Device.
A QR code and link appear — they work for 15 minutes.
Scan the QR code (or open the link) on the new device.
Pick yourself and sign in with your PIN. That’s it — the new device is set up.
No signed-in device handy? Your recovery kit or family passphrase opens your family’s data on a fresh device too.
Trusted devices and signing out
A trusted device is one you use yourself. When you sign out of it, it keeps what it needs to let you straight back in with your PIN. The device you create or join your family on is trusted automatically. Any other device asks you, the first time you sign in, whether to trust it.
The sign-out screen shows whether this device is trusted, with a tick you can change right there. On a borrowed or shared device, untick it, or choose the option to clear all data from the device, so nothing is left behind for the next person.
If you haven’t saved your recovery kit, signing out of a device that won’t keep your key asks you to create one first. You can still choose Sign out anyway, but if that device was your only way in, you could lose access to your family’s data for good.
What about passwords?
New families don’t have passwords at all. If you created your family before PINs arrived, your old password still works to sign in on a new device — and once you’re in, beanies offers to set up a PIN so you can leave the password behind.
The honest trade-off
beanies is built so that nobody but your family — not even us — can open your data. That means there is no “reset by email”: we hold nothing that could unlock it. If every signed-in device is gone, the recovery kit is lost, and no family passphrase was set, the data is unrecoverable. That’s not a punishment — it’s the proof that no one else could get in either.
This is intentional. It’s the same reason a safe deposit box key can’t be conjured up by the bank — the security depends on no one else having a way in.
You’ll rarely need the kit itself: any family member with a signed-in device can link your new device, and a pod manager can reset your PIN. The kit is for the day all of that is gone — which is exactly why it’s worth storing well.