A computer-implemented method for generating escrow key validation data, the computer-implemented method comprising performing computer-implemented operations for: receiving, using a computer, an instruction to save a file; generating, using the computer, a secure hash by using a secret key and some public information specific to an escrow key for which the secure hash is generated, the secret key being randomly or pseudo-randomly generated and being used to encrypt the file, wherein the secure hash is a Hash-based Message Authentication Code, so-called HMAC, and wherein the escrow key is created by encrypting the secret key with a public key; and wherein an encrypted secret key is created by encrypting the secret key using a password provided by the user; hashing, using the computer, the public key using the secure hash to generate validation data for the escrow key, wherein the validation data is generated for use as part of a validation operation to validate the escrow key during a later operation performed on the file; and saving, using the computer, the validation data, the public key, the escrow key and the encrypted secret key; further comprising: receiving an instruction to open the file; in response to receiving the instruction to open the file, requesting user input for decryption of the encrypted secret key; receiving user input responsive to requesting the user input; determining if the user input is valid based upon comparing the user input to an expected user input; in response to determining that the user input is valid, decrypting the encrypted secret key, generating a further secure hash by using the decrypted secret key and said public information specific to the escrow key for which the further secure hash is generated, hashing the public key using the further secure hash to generate further validation data for the escrow key, comparing the validation data to the further validation data, if the validation data matches the further validation data, determining that the escrow key is valid and opening the file, and if the validation data does not match the further validation data, determining that the escrow key is not valid and removing the invalid escrow key from the file. receiving, using a computer, an instruction to save a file; generating, using the computer, a secure hash by using a secret key and some public information specific to an escrow key for which the secure hash is generated, the secret key being randomly or pseudo-randomly generated and being used to encrypt the file, wherein the secure hash is a Hash-based Message Authentication Code, so-called HMAC, and wherein the escrow key is created by encrypting the secret key with a public key; and wherein an encrypted secret key is created by encrypting the secret key using a password provided by the user; hashing, using the computer, the public key using the secure hash to generate validation data for the escrow key, wherein the validation data is generated for use as part of a validation operation to validate the escrow key during a later operation performed on the file; and saving, using the computer, the validation data, the public key, the escrow key and the encrypted secret key; further comprising: receiving an instruction to open the file; in response to receiving the instruction to open the file, requesting user input for decryption of the encrypted secret key; receiving user input responsive to requesting the user input; determining if the user input is valid based upon comparing the user input to an expected user input; in response to determining that the user input is valid, decrypting the encrypted secret key, generating a further secure hash by using the decrypted secret key and said public information specific to the escrow key for which the further secure hash is generated, hashing the public key using the further secure hash to generate further validation data for the escrow key, comparing the validation data to the further validation data, if the validation data matches the further validation data, determining that the escrow key is valid and opening the file, and if the validation data does not match the further validation data, determining that the escrow key is not valid and removing the invalid escrow key from the file. receiving an instruction to open the file; in response to receiving the instruction to open the file, requesting user input for decryption of the encrypted secret key; receiving user input responsive to requesting the user input; determining if the user input is valid based upon comparing the user input to an expected user input; in response to determining that the user input is valid, decrypting the encrypted secret key, generating a further secure hash by using the decrypted secret key and said public information specific to the escrow key for which the further secure hash is generated, hashing the public key using the further secure hash to generate further validation data for the escrow key, comparing the validation data to the further validation data, if the validation data matches the further validation data, determining that the escrow key is valid and opening the file, and if the validation data does not match the further validation data, determining that the escrow key is not valid and removing the invalid escrow key from the file.