Encrypting data using a private key, and encrypting the private key by generating a first encrypted version of the private key using a first master key, and generating a second encrypted version of the private key using a second master key. The first master key is split into shares including a user input key share derived from user authentication data, and the second master key is split into shares including a remote key share stored on a remote server. Data access when the device is offline is provided by reconstructing the first master key using the user input key share, in order to decrypt the first encrypted version of the private key. Data access when the device is online is provided by reconstructing the second master key using the remote key share, in order to decrypt the second encrypted version of the private key.