A computer-implemented method carried out by a server and a user device comprising: receiving, by the server, a request for recovery of an account associated with a user; sending, by the server, a challenge to the user device associated with the user; receiving, by the server, an answer to the challenge and a confirmation code wrapped by an encryption key derived from a provisional master password; sending, by the server, a notification of the request for recovery to one or more devices associated with trusted entities authorized by the user; receiving, by the server, a respective confirmation of the request from the one or more devices associated with the trusted entities, the respective confirmation including a respective recovery token associated with a corresponding one of the trusted entities and a keyed-hash message authentication code keyed with the confirmation code provided by the user device to the corresponding one of the trusted entities, wherein the respective recovery tokens received from the one or more devices comprise respective pieces of an account recovery key encrypted with a public key associated with the user; determining, by the server, that a consensus status has been reached responsive to a threshold number of the respective recovery tokens received from the one or more devices being reached; sending, by the server, the respective recovery tokens and the respective keyed-hash message authentication code associated with each of the one or more devices to the user device, a private key of the user to be used by the user device to decrypt the public key to recover the respective pieces of the account recovery key, and respective ones of the keyed-hash message authentication codes to be used by the user device to verify the respective pieces of the account recovery key; and promoting, by the server, the provisional master password to a master password for the account based on an authentication token one-time-password corresponding to the recovered and verified pieces of the account recovery key by the user device, the server to maintain no copy of the master password. receiving, by the server, a request for recovery of an account associated with a user; sending, by the server, a challenge to the user device associated with the user; receiving, by the server, an answer to the challenge and a confirmation code wrapped by an encryption key derived from a provisional master password; sending, by the server, a notification of the request for recovery to one or more devices associated with trusted entities authorized by the user; receiving, by the server, a respective confirmation of the request from the one or more devices associated with the trusted entities, the respective confirmation including a respective recovery token associated with a corresponding one of the trusted entities and a keyed-hash message authentication code keyed with the confirmation code provided by the user device to the corresponding one of the trusted entities, wherein the respective recovery tokens received from the one or more devices comprise respective pieces of an account recovery key encrypted with a public key associated with the user; determining, by the server, that a consensus status has been reached responsive to a threshold number of the respective recovery tokens received from the one or more devices being reached; sending, by the server, the respective recovery tokens and the respective keyed-hash message authentication code associated with each of the one or more devices to the user device, a private key of the user to be used by the user device to decrypt the public key to recover the respective pieces of the account recovery key, and respective ones of the keyed-hash message authentication codes to be used by the user device to verify the respective pieces of the account recovery key; and promoting, by the server, the provisional master password to a master password for the account based on an authentication token one-time-password corresponding to the recovered and verified pieces of the account recovery key by the user device, the server to maintain no copy of the master password.