Lock the vault

How-to

Lock the vault

The on-device vault encrypts saved provider keys, sign-in tokens, tool, custom API, live-view and backup credentials. Setting a device password adds a second layer: the vault's encryption key is itself protected by a key derived from your password, so the vault stays locked even if someone reads the device's storage. Without a password the vault is still encrypted, but the key is protected only by the device. Other app data, such as chats and settings, is not encrypted.

  1. 1

    Settings → Device lock & backup.

  2. 2

    Set a device password (minimum 6 characters) — derives the AES-GCM key for the on-device vault.

  3. 3

    Set an auto-lock timer for idle sessions.

  4. 4

    Generate a recovery key and store it in your password manager or HSM.

Set device lock

Related