Method to manage modification of encryption credentials (U/P) of a user for an encryption server, said encryption server being used to encrypt data (F1,F2) uploaded by the user after provision of the encryption credentials (U/P) of the user associated to an encryption account, said data thus encrypted ( Ku, Ku) using a user encryption key (Ku) being stored in a cloud storage server, said method comprising the initialization steps of, for the encryption server, authenticating the user to the encryption account using encryption credentials (U/P) and binding the encryption account to a user's storage account in the cloud storage server through the following sub-steps: - for the cloud storage server, authenticating the user to the storage account of the user using storage credentials ((U/P)s), issuing an initial access token based on an online authentication protocol and sending the initial access token to the encryption server, to be used by the encryption server for the subsequent communication with the cloud storage server, and - for the encryption server, encrypting the initial access token and the user encryption key (Ku) using the encryption credentials (U/P) and storing them at the encryption server for further use to decrypt the uploaded data (F1,F2) under request of the user and provision of the encryption credentials (U/ P) of the user, encrypting the user encryption key (Ku) using an encryption server recovery master key (Kr_pub) and sending, for storage, the encrypted user encryption key ([Ku]Kr_pub) to the cloud storage server, said method further comprising the following steps, when the user triggers an encryption credentials reset, - for the cloud storage server, authenticating the user to the storage account of the user using the storage credentials ((U/P)s), issuing a new access token (AT') based on an online authentication protocol and sending the new access token (AT') to the encryption server, and - for the encryption server, using the new access token (AT') to retrieve the encrypted user encryption key ([Ku]Kr_pub) from the cloud storage server, decrypting the encrypted user encryption key (Ku) using a encryption server recovery master key (Kr_pr), requiring new encryption credentials (U/P') to be input by the user, encrypting the new access token (AT') and the plain decrypted user encryption key (Ku) using the new encryption credentials (U/P') and storing them at the encryption server for further use to decrypt the uploaded data (F1,F2) under request of the user and provision of the new encryption credentials (U/P') of the user. - for the cloud storage server, authenticating the user to the storage account of the user using storage credentials ((U/P)s), issuing an initial access token based on an online authentication protocol and sending the initial access token to the encryption server, to be used by the encryption server for the subsequent communication with the cloud storage server, and - for the encryption server, encrypting the initial access token and the user encryption key (Ku) using the encryption credentials (U/P) and storing them at the encryption server for further use to decrypt the uploaded data (F1,F2) under request of the user and provision of the encryption credentials (U/ P) of the user, encrypting the user encryption key (Ku) using an encryption server recovery master key (Kr_pub) and sending, for storage, the encrypted user encryption key ([Ku]Kr_pub) to the cloud storage server, said method further comprising the following steps, when the user triggers an encryption credentials reset, - for the cloud storage server, authenticating the user to the storage account of the user using the storage credentials ((U/P)s), issuing a new access token (AT') based on an online authentication protocol and sending the new access token (AT') to the encryption server, and - for the encryption server, using the new access token (AT') to retrieve the encrypted user encryption key ([Ku]Kr_pub) from the cloud storage server, decrypting the encrypted user encryption key (Ku) using a encryption server recovery master key (Kr_pr), requiring new encryption credentials (U/P') to be input by the user, encrypting the new access token (AT') and the plain decrypted user encryption key (Ku) using the new encryption credentials (U/P') and storing them at the encryption server for further use to decrypt the uploaded data (F1,F2) under request of the user and provision of the new encryption credentials (U/P') of the user.