> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/drive-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/drive-support/playbooks/rotate-keys.md).

# Rotate keys

**What you'll do:** Re-encrypt a vault's contents under fresh keys.

**Why it matters:** Rotating keys after a password change (or whenever you want a clean cryptographic break) limits the value of any old key material. Oten Drive can rotate automatically or on demand.

### Automatic rotation <a href="#automatic-rotation" id="automatic-rotation"></a>

* After you **change a vault password**, the app **prompts** you to rotate.
* A progress panel shows the rotation and lets you **pause / resume**.
* Rotation moves through clear states (waiting → processing → done).

### Manual rotation <a href="#manual-rotation" id="manual-rotation"></a>

* Trigger rotation any time from the **vault context menu**.

**Steps**

1. Choose **Rotate keys** (or accept the prompt after a password change).
2. **Make sure sync is enabled** — rotation requires sync so the client and server stay consistent. The app will hold rotation until sync is on.
3. Let the progress panel run; pause and resume if you need to.
4. Wait for **done** before relying on the rotated state on other devices.

**Common mistakes**

* **Starting rotation with sync disabled.** It won't proceed — enable sync first to avoid an inconsistent state.
* **Quitting mid-rotation and assuming it finished.** Reopen and confirm the panel shows *done*.
* **Rotating on one device and switching to another too soon.** Let sync catch up so the other device sees the new keys.

> Rotation is about hygiene, not daily use — most people rotate after a password change or a suspected exposure.