How Does JumpCloud Password Manager Recovery and Sharing Work?

Introduction

JumpCloud Password Manager (JCPM) is different from LastPass or 1Password because it is decentralized. There is no "Master Password" to reset. This architecture offers higher security but requires specific admin workflows to avoid data loss.

1. How "Zero Knowledge" Architecture Works

Unlike traditional managers, JCPM uses the user's JumpCloud Login to unlock a local vault.

• The vault is encrypted on the device.

• It syncs to the cloud via an encrypted tunnel.

• Critical Warning: If a user forgets their JumpCloud password and you reset it in the console, their local vault cannot decrypt because the keys no longer match.

2. The "Account Recovery" Workflow

You cannot just "reset" a password and expect JCPM to work. You must plan for recovery.

• Step 1: Enable Cloud Backup (Policy).

  • In the Admin Console, enable the "Cloud Backup" policy for JCPM. This forces an encrypted backup of the vault to JumpCloud's servers.

• Step 2: The Restoration Event.

  • User forgets password.

  • Admin resets JumpCloud password.

  • User logs in. JCPM prompts: "Your password changed. Enter previous password or Restore from Backup."

  • User selects Restore from Backup. They will need their Recovery Code (generated during setup).

3. Migrating from LastPass/Keepass

JCPM supports .csv import, but the format is strict.

• Best Practice: Have users export their old vault to CSV.

• Sanitization: Ensure the CSV headers match JCPM requirements: url, username, password, totp.

• Import: User opens JCPM > File > Import > CSV.

4. Shared Folders (Team Access)

JCPM allows sharing passwords (e.g., "Marketing Social Accounts") without revealing the actual characters.

• Admin Control: You cannot "see" into a user's shared folder. You can only manage who is in the sharing group.

• Setup:

  1. Create a User Group "Marketing Team".

  2. User A (Manager) creates a Shared Folder in JCPM and invites the "Marketing Team" group.

  3. User B (New Hire) is added to the "Marketing Team" in JumpCloud Console.

  4. User B automatically sees the Shared Folder in their JCPM app.

FAQ

1) Why can’t admins reset passwords directly in JumpCloud Password Manager?

JCPM uses a zero-knowledge model. Resetting the JumpCloud password breaks the vault key unless the user restores from a cloud backup with a recovery code.

2) How do users recover their JCPM vault after a password reset?

They must select “Restore from Backup” and enter their recovery code if the Cloud Backup policy was enabled beforehand.

3) Can JumpCloud admins view passwords in shared folders?

No. Admins cannot see vault contents. They can only manage user group membership that controls shared folder access.

4) How do I migrate passwords from LastPass or KeePass to JCPM?

Export the old vault as CSV, ensure headers match JCPM format (url, username, password, totp), then import through the JCPM app.

5) What happens if Cloud Backup was not enabled before a password reset?

The user’s encrypted vault cannot be decrypted, and saved passwords are permanently lost.