How to store your tagl

Your tagl is a PNG file that contains your cryptographic identity — and, if you use the built-in vault, your two-factor (TOTP) secrets. The file is your access: whoever holds a copy and knows the PIN can use it, and if all copies are gone, access is gone permanently — no one, including us, can restore it.

It looks like an ordinary image. Treat it as a credential file whose exact bytes must be preserved.

This page is the one document worth reading in full.

The three rules

1. Keep at least three copies in different places. One working copy on your primary device, one on a separate device or removable drive, one in another protected location. Never keep all copies on storage that can fail or be wiped together.
2. Never let the file be re-encoded. The identity data is embedded in the image itself. Anything that recompresses, resizes, converts, or "optimizes" the PNG destroys it — even if the picture still looks identical.
3. After changing your tagl, back it up again. Copies made earlier do not contain later changes: a two-factor secret you added yesterday, or a PIN change, is not in the copy you made last month. Never delete your last known-working backup until its replacement is verified.

Where to keep copies

Good:

• A USB drive or external disk kept offline.
• An encrypted archive (e.g., a password-protected ZIP) on a hard drive.
• Cloud file storage that preserves files byte-for-byte — preferably inside an encrypted archive.

Never:

• Messengers and social networks (WhatsApp, Telegram galleries, Instagram, etc.) — they re-encode images and will silently destroy the embedded data.
• Photo services and galleries (Google Photos, iCloud Photos in optimized mode) — same reason. An "original quality" option is not a guarantee; verify the downloaded copy yourself before trusting it.
• Image editors — opening is fine; saving from an editor destroys the data. So does cropping, rotating, or applying any filter.
• Screenshots — a screenshot of a tagl is a picture of a key, not the key. It contains none of the embedded data.

Renaming the file is safe. Changing its contents in any way is not. Tip: storing the tagl inside a ZIP archive protects it from accidental re-encoding — services treat archives as opaque files.

Cloud backup and the 12 recovery words

Tagl ID includes an optional encrypted cloud backup, enabled in your dashboard. When you turn it on:

• An encrypted copy of your tagl is stored on our side. It is encrypted on your device before upload — we store ciphertext we cannot read.
• You are shown 12 recovery words. They are the only way to locate and decrypt that backup. Write them down and store them offline, separately from your devices; you can view them again in the dashboard while you still have access.
• To restore, open the recovery page and enter the words — no file needed. While backup is enabled, it is kept current automatically.

Two things the words are not:

• Not a PIN bypass. The restored tagl still asks for your PIN. Forgotten PIN is not recoverable by the words.
• Not harmless. Anyone with the 12 words can download and decrypt your backup — treat the words with the same care as a copy of the file itself (the PIN remains the last barrier).

Cloud backup plus one local copy is the recommended setup. With backup off, the file copies below are all you have.

Verify every copy

A backup you have never tested is a hope, not a backup. Verify after creating a copy and after downloading it back from remote storage.

• Byte check: a correct copy is byte-identical to the original. Compare checksums (e.g., sha256sum tagl.png on both files — the values must match). Do not rely on the file name, preview, dimensions, or file size — they can all match while the embedded data is destroyed.
• Live check: open the copy in the app (the recovery page accepts a tagl file) and confirm it loads and unlocks.

A matching checksum proves the copy matches its source — it does not prove the source was healthy. Always create backups from a tagl you have just successfully used.

If your tagl may have been exposed

If someone may have obtained a copy of your file:

1. Your PIN is the remaining barrier — the file alone is not enough. Do not assume that barrier will hold forever.
2. Understand what does not help: copying your tagl to a new location, or changing the PIN on your copies, does not affect the copy the attacker holds — it still contains the same keys under the old PIN.
3. Revoke active sign-in sessions in your dashboard (Sessions tab).
4. Treat the identity as compromised: create a new tagl and stop using the old one. Accounts on third-party sites are re-linked through each site's own account settings — sign in there while you still control the account and switch it to your new identity or another login method.
5. For TOTP secrets stored in the vault, use each third-party site's own process to rotate the affected secret.

If your PIN may have been exposed too, act immediately — the attacker has everything they need. Do not delete your own last usable copy while responding.

If you lost your tagl

• Cloud backup was enabled: open the recovery page and enter your 12 recovery words — the tagl is restored without a file.
• You have a file copy: load any intact copy in the app. You lose nothing. If the lost copy may be in someone else's hands, also treat it as a possible compromise (above).
• No copies, no backup (or the words are lost too): access is permanently lost, including TOTP secrets stored inside. There is no reset procedure, because the Operator never holds your keys or your words. This is the price of a design in which no one but you can access your identity.