The answer, step by step
- 01The 12 words are the recovery key
Words, order, and spelling determine the device-derived decryption key. The phrase is not written to CloudKit.
- 02The password is the daily lock
The daily password protects current-device access. If forgotten, the complete phrase and available ciphertext provide the recovery path.
- 03Face ID is local authorization
Face ID is tied to current biometric enrollment. It is convenient local access, not a cross-device recovery credential.
- 04The Apple Account is the cloud address
It controls who can retrieve CloudKit records, but signing in alone should not reveal plaintext.
- 05Separate key from safe
Write the phrase on durable offline media in a physical safe or controlled location. Do not screenshot, photograph, email, or store it inside Vault.
How to check this claim
Run a non-sensitive recovery drill: enter the complete phrase and confirm GCM authentication succeeds, then change one word and confirm recovery fails clearly.
See the full verification protocol →What this answer does not claim
Direct answers
How is the password different from the phrase?
The password protects daily access; the phrase provides final recovery. Remembering the password does not replace keeping the phrase offline.
Can Face ID recover a new iPhone?
No. Face ID is local-device authorization, not a cross-device recovery key.
Can I keep the phrase in iCloud Notes?
It is not recommended. That places ciphertext and its final key in a similar online risk domain and weakens separated custody.