Account, teams and sync

What each field, switch and setting does, 105 controls in all on this page. This is the text behind the ⓘ beside each label in the apps: hover or click it on the desktop (or press F1 in the field), tap it on the phone.

The line under each name gives the id the code uses for it, and says when only one of the apps has it.

Account: log in, create, recover

Where: Settings › Account & Sync.

Server URL

account.serverUrl

The address of the Sternway sync server you or your organisation runs. An account lives on one server; the app works without one, and then nothing leaves this device.

• Example: https://sternway.example.com
• Caution: Use https://. Plain http:// sends your sign-in unprotected; desktop accepts it only for a server on this same computer.
• More: Read more

Email

account.email

The email address your account is registered under on that server. It is your user name there.

• Example: ada@example.com

Password

account.password

Your account password. It proves who you are to the server and also unlocks your encrypted data on this device; the password itself is never sent.

Authenticator code

account.totp · also shown as “6-digit code”

The 6-digit code your authenticator app (Google Authenticator, Aegis, 1Password and the like) shows for Sternway right now. Asked only when two-factor authentication is on for the account.

• Example: 492 817

Name

account.name

The name teammates see for you, for example in a team’s member list. Up to 256 characters.

• Example: Ada Lovelace

Password

account.newPassword · also shown as “New password”

The password for the account, at least 8 characters. It also encrypts your data before anything is uploaded, so the server never sees your hosts or keys.

• Caution: Nobody can reset it for you, not even the server’s administrator. If you forget it, only your recovery kit gets you back in.

Confirm password

account.confirmPassword · also shown as “Confirm new password”

Type the same password again, to catch a typo while it can still be fixed.

Recovery key

account.recoveryKey

The 52-character key from your recovery kit, the page you printed or saved when you created it. Spaces, dashes and capitals do not matter.

• Example: ABCD-EFGH-JKMN-…
• Caution: Recovering sets a new password and makes this recovery kit useless: create a new kit afterwards.

Encryption password

account.ssoEncryptionPassword

Single sign-on proves who you are, but it cannot unlock your data. This separate password encrypts and unlocks your vaults on your devices and never leaves them. At least 8 characters when you first set it.

• Caution: Your organisation cannot reset it. Keep a recovery kit.

SSO organization

account.ssoOrganization

The short name of your team’s single sign-on, which your team owner chose and gave you. Sternway sends you to that team’s identity provider (Okta, Entra ID, Google Workspace, Keycloak and the like). Leave it empty to use the sign-in provider of the server itself, when it has one.

• Example: acme
• Caution: Names are first come, first served on a server. Before the browser opens, Sternway shows the team’s name and the identity provider’s address: continue only if both are yours.
• More: Read more

Account: profile and security

Where: Settings › Account & Sync, when logged in.

Display name

profile.name · Desktop only

The name teammates see for you. Required, up to 256 characters.

Email

profile.email · Desktop only

The new email address for your account. You log in with it from then on.

Current password

account.currentPassword

Your account password as it is now, to prove it is you making this change.

New password

security.newPassword

The password to change to, at least 8 characters and different from the current one. Your data stays encrypted; its keys are re-wrapped with the new password.

• Caution: Changing the password makes your recovery kit useless. Create a new one straight after.

Authenticator code

twoFactor.code · also shown as “6-digit code”

The 6-digit code your authenticator app shows after you add the secret above to it. Typing it proves the app is set up, and from then on logging in needs your password and a code.

• Caution: Turning two-factor on shows ten one-time recovery codes once: save them. Turning it off needs a current code and deletes those recovery codes.

Passkey name

account.passkeyName

A name to tell this passkey apart in the list, such as the device or password manager that holds it. Up to 64 characters. Adding the passkey also asks for your password (and your authenticator code when two-factor is on), because a passkey replaces that code at sign-in.

• Example: Work laptop (Windows Hello)
• More: Read more

Code

account.emailCode

The six-digit code your server emailed to the address of your account. Typing it proves the address is yours; teammates then see it marked as verified. A code works for 15 minutes and for five tries; ask for a new one after that.

• More: Read more

I’ve printed or saved my recovery kit

recovery.stored · also shown as “I’ve stored this key somewhere safe”

Tick this once the recovery key is somewhere safe outside this device. It is shown only this once, and it is the one way back in if you forget your password.

• Caution: Whoever has this key and knows your email address can set a new password for the account. Store it like a spare house key, not in a note on this device.

Type DELETE to confirm

danger.typeDelete · Desktop only

A deliberate speed bump: the button works only once you have typed the word DELETE in capitals.

• Caution: Deleting an account removes it and its synced data from the server (restorable for 30 days). Resetting an account permanently deletes every vault and item, with no way back.

Public key directory

Where: Settings › Account & Sync › Public key directory (desktop).

Handle

keyDirectory.handle · Desktop only

A short public name your SSH public keys are published under on your Sternway server, so a server administrator can fetch them without emailing key files around. 3 to 32 lowercase letters, digits or hyphens.

• Example: ada
• Caution: Anyone who can reach the server can read the keys published under a handle, without logging in. Public keys are safe to share, but the handle shows which keys are yours.

Account password

keyDirectory.password · Desktop only

Your account password, needed to change the handle or the published keys.

Keys to publish

keyDirectory.keys · Desktop only

Tick the keys whose public half should be listed under your handle. Only the public half is ever published. With none ticked, publishing removes them all.

Teams and vaults

Where: Settings › Account & Sync › Teams, Vaults (desktop).

Invite link

teams.inviteLink

The link from the invitation email a team owner sent you. Pasting it joins that team with the account you are logged in to. An invitation works once, for 7 days after it was sent, and only for the account whose email address it was sent to.

Team name

teams.name

What the team is called. A team is a group of accounts that share vaults of hosts, keys and snippets. Required, up to 256 characters.

• Example: Platform team

Invite by email

teams.inviteEmail

The email address of the person to invite. They get a link to join; they need, or create, an account on this server with that same email address. The link works once and expires after 7 days; invite them again after that.

Vault access

teams.memberPermission

What this member may do in the vault: “Can edit” lets them change what is in it, “Can view” lets them see and use it without changing it, “Remove access” takes the vault away from them. With “Can view” a member can connect to the vault’s hosts and read its session logs, but cannot add, edit, move, rename or delete anything in it, save a password or a host key to it, or switch its logging.

• Caution: “Can view” is not a way to keep secrets from someone. The app does not offer a view-only member “Export private key” or “Copy private key”, but that is a rule of the app, not of the encryption: their devices receive the vault’s key, so what the vault holds (saved passwords, private keys) can be read there, and its items can be copied into a vault of their own.

Member

teams.accessMember · Desktop only

The team member to give this vault to. Only members who joined the team and have no access to the vault now are listed; invite someone to the team first to add them.

Access ends

teams.accessEnds

When the member’s access to this vault ends by itself. The end is signed into the team’s member list, so every member’s app ends it then, whatever the server says, and the server refuses the member from then on. After it the vault needs a new key, as after removing access: rotate it. Choosing Can edit or Can view again later keeps the end; giving access again without one takes it away.

• Default: Never: until you remove the access.
• Caution: Ending access stops the member’s apps from opening the vault and from getting anything new; what their devices received before the end could have been copied, as with any removal.

Require 2FA

teams.require2fa · Desktop only

Members must have two-factor authentication on their account to open this team’s vaults. It applies at once; members without it are locked out of the team vaults until they turn it on.

• Default: Off.

Record sessions on team hosts

teams.recordSessions · Desktop only

Every member’s desktop app records each session to a host in this team’s vaults, whatever the host or the member’s own settings say, and shows a red “Recording” badge on it. The recordings stay on each member’s own device; Sternway has no upload of recordings to the server. The phone app does not record yet, so phone sessions are not covered.

• Default: Off.
• Caution: A recording holds everything shown in the terminal. Tell your team before turning this on.
• More: Read more

What happens to their account

teams.removeMode · Desktop only

“Convert to individual account” removes them from the team and lets them keep a personal account. “Delete their account” removes the account from the server.

• Default: Convert to individual account.
• Caution: Either way the keys of every vault they could open are replaced, so what they knew stops working.

Transfer ownership

teams.transferTo · Desktop only

The member who becomes the team’s owner once they accept. Until then you stay the owner; afterwards you keep edit access to the team’s vaults.

Leave team

teams.leave

Takes your account out of the team. A member leaves at once: the team’s vaults and their copies on your devices go, your account and your own vault stay. The owner leaves by choosing a new owner, and stays the owner until that member accepts; an owner who is the only member deletes the team instead.

• Caution: What you saved in the team’s vaults stays with the team. Copy anything you need into your own vault first.

New owner

teams.leaveNewOwner

The member who takes the team over. They are asked first: you stay the owner until they accept, and then you leave the team. Until then you can cancel, and they can decline.

Waiting for the new owner

teams.pendingTransfer

You asked a member to take the team over. Nothing changes until they accept; then they own the team, and if you chose to leave, you are out of it. “Cancel transfer” takes the request back.

Take over …?

teams.ownershipOffer

The owner asked you to become the team’s owner. Accepting makes you the owner: you manage its members, vaults and settings, and you get edit access to every team vault. Declining leaves everything as it is and tells the owner.

• Caution: When the owner chose to leave, they lose access to the team’s vaults as you accept, and the vaults they could open are marked for key rotation.

Delete team

teams.delete

Deletes the team for everyone: its vaults with every host, key and snippet in them, its members’ access, pending invites and its audit log. Each member’s devices remove their copies of the vaults at their next sync. Only the owner can do it, and only after typing the team’s name.

• Caution: It cannot be undone. Export the team’s hosts first if you may need them again.

Safety number

teams.safetyNumber

Thirty digits made from an account’s encryption keys. Yours is under Account › Security; each teammate’s is on their row in the team. Compare them in person or over another channel you trust: when they match, the keys really are that person’s, and the server cannot read or change what the team shares. “Mark as verified” remembers that on this device.

• Caution: A number that changes means the account’s keys changed (an account reset, or someone in between). Sternway pauses what depends on it until you compare the new number.
• More: Read more

I compared this number with …

teams.restoreCompared

Tick this once you and the person compared the safety number on this row with the one in their own Account › Security, in person or over another channel you trust. Restore on the row then signs them into the team’s member list with that number and shares exactly the vaults shown. “Restore all” leaves out everyone whose number you have not marked as verified.

• Caution: A number you did not compare may be a key the server put there: whoever holds it can read the vaults you share with it.
• More: Read more

Team name, to confirm

teams.deleteName

Type the team’s name exactly as it is shown, with the same capitals and spaces. Delete team stays off until it matches.

Backup password

teams.exportPassword

The password that encrypts the file “Export the team’s hosts first” writes, at least 8 characters. The file holds the team’s vaults only, keys and saved passwords included. Restored after the team is gone, what it holds goes into your own vault.

• Caution: It cannot be recovered: without it the file cannot be opened. Anyone with the file and the password has every key the team’s vaults hold.

Single sign-on (SAML)

teams.saml · Desktop only

Lets the team’s members sign in through your organisation’s identity provider (Okta, Entra ID, Google Workspace, Keycloak and others that speak SAML 2.0). It proves who they are; their own encryption password still unlocks their data.

• Default: Not set up.
• More: Read more

SSO organization name

teams.samlOrganization · Desktop only

The short name members type at “Sign in with SSO” to reach this team’s identity provider. Unique on the server; lowercase letters, digits and dashes.

• Example: acme
• More: Read more

IdP metadata URL

teams.samlMetadataUrl · Desktop only

Where your identity provider publishes its SAML metadata. Sternway (this app, not the server) downloads it and fills in the entity ID, sign-in URL and signing certificates. Fetch it again after the provider rotates its certificate.

• Example: https://login.example.com/app/sternway/sso/saml/metadata

IdP metadata XML

teams.samlMetadataXml · Desktop only

The identity provider’s SAML metadata document, pasted or loaded from a file, when it has no URL to fetch it from.

IdP entity ID

teams.samlEntityId · Desktop only

The identity provider’s name for itself (its Issuer). Every sign-in it sends must carry exactly this value.

• Example: https://sts.windows.net/0000…/

IdP sign-in URL

teams.samlSsoUrl · Desktop only

The identity provider’s single sign-on address for the HTTP-Redirect binding. Members’ browsers are sent there to sign in.

• Caution: Must use https:// (plain http:// is accepted only for a provider on the server’s own machine).

Signing certificate

teams.samlCert · Desktop only

The certificate (PEM) your identity provider signs sign-ins with. A sign-in signed with any other key is refused.

Second signing certificate

teams.samlCert2 · Desktop only

The next certificate while your identity provider rotates its signing key: both are accepted until you remove the old one.

• Default: Empty: only the first certificate is accepted.

Email attribute

teams.samlEmailAttribute · Desktop only

The SAML attribute that carries the member’s email address.

• Default: Empty: the NameID when its format is emailAddress, else an attribute named email or mail.
• Example: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

Name attribute

teams.samlNameAttribute · Desktop only

The SAML attribute that carries the member’s display name, shown when a new account is created.

• Default: Empty: an attribute named displayName or name, else the email address.

Require SSO for members

teams.samlRequire · Desktop only

Members (not you, the owner) can then sign in to Sternway only through this team’s identity provider; signing in with the password alone or another provider is refused. They still type their encryption password.

• Default: Off.
• Caution: You keep password sign-in, so you can fix a broken setup. A member who leaves the team can sign in with the password again.

Activity digest

teams.digest · Desktop only

An email summary for the owner of what changed in the team’s vaults: who changed what and when, never the contents.

• Default: Off.

Team

vaults.team · Desktop only

The team the new vault belongs to. Its members can be given access to the vault.

Vault name

vaults.name · Desktop only

What the vault is called. A vault is a separately encrypted collection of hosts, keys and snippets that can be shared with a team. Required, up to 256 characters.

• Example: Production servers

Team policies

Where: Settings › Account & Sync › Teams › a team › Policies.

Policy

teamAdmin.mode

“No policy” leaves the setting to each member. “Suggested” applies where a member has no setting of their own, and they can use theirs instead. “Locked” is a floor: members can make it stricter, never looser.

• Default: No policy.
• Caution: Making a policy looser asks you to confirm it is you, and the owner is told.
• More: Read more

Reason

teamAdmin.reason

Why the policy is set, shown to members beside the setting as plain text. Up to 280 characters. The sync server can read it.

• More: Read more

Require two-factor authentication

policy.auth.require2fa

Members need two-factor authentication on their account to use this team’s vaults, statements and reports. Sign-in and personal vaults are never blocked. Enforced by the server.

• Default: No policy.
• More: Read more

Require logging in with a passkey

policy.auth.requirePasskey

Who must have signed in with a passkey to use this team’s resources: everyone, or only the owner, admins and roles that sign changes. Enforced by the server. Can’t be combined with Require single sign-on.

• Default: No policy.
• More: Read more

Require single sign-on

policy.auth.requireSso

Members sign in to this team through your organisation’s single sign-on. Only the owner changes it.

• Default: No policy.
• More: Read more

Oldest app version allowed

policy.apps.minVersion

Apps older than this version can’t use this team’s resources until they are updated. Admins can raise it only up to a version other members’ devices already report; the owner’s sessions are never locked out.

• Default: No policy.
• Caution: A raise applies to existing sessions 24 hours after it is signed; Reports lists the devices it would lock out.
• More: Read more

Require the app lock

policy.lock.required

Turns on the app lock on every member’s device. Applied by each member’s app.

• Default: No policy.
• More: Read more

Lock the app after at most

policy.lock.maxMinutes

The longest a member’s app may stay unlocked while idle, in minutes (1 to 1440). A member’s own shorter time stays.

• Default: No policy.
• More: Read more

Allow local shells

policy.localShell.allowed

Whether members may open a shell on their own computer while they use this team’s hosts. Off is stricter.

• Default: No policy.
• More: Read more

Clear copied secrets after at most

policy.clipboard.maxClearSec

How long a copied password or key may stay on the clipboard, in seconds (1 to 3600). A member’s own shorter time stays.

• Default: No policy.
• More: Read more

Log in with keys only, no passwords

policy.hosts.keysOnly

Team hosts log in with keys only: passwords aren’t saved or sent for them. Applied by each member’s app.

• Default: No policy.
• More: Read more

Unknown host keys

policy.ssh.hostKeyPolicy

“Refuse unknown keys” never connects to a host whose key is not known yet; “Ask” asks the member first.

• Default: No policy.
• More: Read more

SSH agent forwarding

policy.ssh.agentForwarding

What the SSH agent forwards to team hosts, on every hop: nothing, only the key used to log in, or all keys. Stricter values win over a member’s own setting.

• Default: No policy.
• Caution: A forwarded agent lets anyone with root on the host use your keys while you are connected.
• More: Read more

Allow legacy SSH algorithms

policy.ssh.legacyAlgorithms

Whether connections to team hosts may use old, weaker SSH algorithms (for old devices). Off is stricter.

• Default: No policy.
• More: Read more

Port forwards listen on this device only

policy.forwards.loopbackOnly

Port forwards to team hosts listen only on the member’s own computer, not on its network.

• Default: No policy.
• More: Read more

Members may add hosts

policy.hosts.membersMayAdd

Whether members who don’t sign changes may add hosts to the team’s vaults. Enforced by the server.

• Default: No policy.
• More: Read more

Export without encryption

policy.export.plaintext

Whether team data may be exported to a file without encryption. Blocked still allows encrypted backups, and a team private key exported or copied with a passphrase; the team owner’s keys leave either way. The team’s hosts are left out of the inventory CSV, and recordings of its hosts are not exported.

• Default: No policy.
• More: Read more

Copy or move items out of the team

policy.items.copyOut

“Only within the team” keeps hosts, keys and snippets from being copied or moved to a personal vault or another team’s, and keeps the team’s private keys from being exported or copied, even with a passphrase. Copying and moving between the team’s own vaults still works, and the team owner can still export keys.

• Default: No policy.
• More: Read more

AI assistant

policy.ai.mode

Whether the AI assistant may be used with team hosts: off, only with the approved providers below, or with any provider.

• Default: No policy.
• More: Read more

Approved AI providers

policy.ai.approvedProviders

The addresses (https origins) of AI providers members may use with team hosts when the assistant is limited to approved providers. A provider matches only when its address is exactly one of these.

• Default: None.
• More: Read more

Session sharing

policy.share.mode

Whether members may share a session to a team host: off, read-only, or with control.

• Default: No policy.
• More: Read more

Longest session share

policy.share.maxHours

How long a session share may last, in hours (1 to 168).

• Default: No policy.
• More: Read more

Folder sync may include team data

policy.folderSync.teamData

Whether folder sync may write team vaults to a sync folder. Off is stricter.

• Default: No policy.
• More: Read more

Longest vault access

policy.grants.maxDays

The longest access to a team vault anyone but the owner may give, in days (1 to 3650). Enforced by the server.

• Default: No policy.
• More: Read more

Record sessions

policy.recording.required

Every member’s app records sessions to team hosts. Only the owner changes it.

• Default: No policy.
• Caution: A recording holds everything shown in the terminal. Tell your team before turning this on.
• More: Read more

Keep recordings at most

policy.retention.recordingsMaxDays

The longest a member’s device keeps recordings of team sessions, in days (1 to 3650). Admins may only raise it; only the owner lowers it.

• Default: No policy.
• Caution: A lower value deletes older recordings.
• More: Read more

Keep session logs on the server for

policy.retention.sessionLogsMaxDays

How long the server keeps the team’s session logs, in days (1 to 3650). Admins may only raise it; only the owner adds, lowers or removes it.

• Default: No policy.
• Caution: A lower value deletes older logs.
• More: Read more

Keep the audit log for

policy.audit.retentionDays

How long the server keeps the team’s audit log, in days: 0 keeps it forever, else at least 30. Admins may only raise it; only the owner adds, lowers or removes it.

• Default: No policy.
• Caution: A lower value deletes older audit events.
• More: Read more

Team roles, governance, upgrade and restore

Where: Settings › Account & Sync › Teams › a team.

Role

teamAdmin.role · also shown as “Role of …”

What this member may do in the team: Member, Admin, or a custom role. A role that signs changes goes only to a member whose safety number you verified.

• Default: Member.
• More: Read more

Role name

teamAdmin.roleName

The role’s name, shown on member rows. Up to 280 characters. The sync server can read it.

• More: Read more

Permissions

teamAdmin.perms

What holders of the role may do. Inviting, removing, creating, sharing, rotating, deleting and managing policies sign team changes; viewing reports and exporting the audit log don’t.

• More: Read more

Admins may delete vaults

teamAdmin.adminsMayDeleteVaults

Lets admins with edit access to a vault delete it. You can restore a deleted vault for 30 days.

• Default: Off.
• More: Read more

Deleting a vault needs your approval

teamAdmin.deleteApproval

An admin’s deletion is sent to you as a proposal instead of happening at once.

• Default: Off.
• More: Read more

Relaxing a policy needs your approval

teamAdmin.relaxApproval

An admin’s relaxation of a policy is sent to you as a proposal instead of happening at once.

• Default: Off.
• More: Read more

Delay before a relaxation takes effect

teamAdmin.relaxDelay

How long the stricter setting stays after an admin relaxes a policy, so you can revert it: none, 15 minutes, 1 hour, 4 hours or 24 hours.

• Default: No delay.
• More: Read more

Close the lost versions

teamAdmin.closeLost

Old vault keys this device never had can’t be committed to the new member list. Closing them keeps items written under them readable where the key is held, and nothing is written under them again.

• More: Read more

Who signs changes

teamAdmin.signing

Owner and admins: admins and roles you grant sign changes within the rules. Only you: you sign every change, and admins can propose.

• Default: Owner and admins.
• More: Read more

Apply …’s policy to my own hosts and keys on this device

teamAdmin.personalOptIn

The team’s policy covers its own vaults. On, it also covers your personal hosts, keys and settings on this device: its locked values are a floor there too. It applies on this device only, and only you can change it.

• Default: Off.
• More: Read more

Name of the new vault

teamAdmin.restoreName

The name of the vault made from this device’s copy. It gets new keys; members get access only when you give it.

• More: Read more

Sync through a folder

Where: Settings › Account & Sync › Sync through a folder, when not logged in (desktop and Android).

Folder

folderSync.folder

A folder that a sync tool you already use carries to your other devices: Dropbox, OneDrive, Google Drive for desktop, iCloud Drive, Syncthing or a network share. On a phone, a folder on it that a sync app (such as Syncthing) keeps in step. Sternway makes a “Sternway Sync” folder in it and writes only encrypted files there. Every device you sync points at the same folder.

• Example: ~/Dropbox
• Caution: Use a folder only you can open. Anyone who has the files and your sync passphrase can read your hosts and keys.
• More: Read more

Sync passphrase

folderSync.passphrase

Encrypts everything Sternway writes to the folder. The first device sets it; each other device asks for it once, when you turn folder sync on there. At least 12 characters; a few unrelated words are easy to type and hard to guess.

• Caution: Nobody can recover it for you. The devices that already sync keep working without it, but a new device cannot join, so keep it in your password manager.
• More: Read more

Confirm sync passphrase

folderSync.confirmPassphrase

Type the same passphrase again, to catch a typo.

Turn off

folderSync.turnOff · Desktop only

This device stops reading and writing the folder. Your hosts, keys and settings stay here as they are, and the folder keeps its files for your other devices.

App lock

Where: Settings › Security › App lock; the lock screen.

Current PIN or passphrase

appLock.current · also shown as “Current PIN”

The code that unlocks the app now, needed to change it or turn the lock off.

New PIN or passphrase

appLock.new · also shown as “New PIN”

The code you will type to open the app, at least 4 characters (on a computer without a system keychain, where it is also the passphrase that encrypts the data: at least 8, and not digits only). The app then starts locked and locks again when idle. Locking hides the app; your sessions keep running.

• Caution: There is no “forgot my PIN”: only a salted hash is stored (plus, on a phone with fingerprint or face unlock on, the PIN itself in the phone’s secure storage). Too many wrong tries make the app wait longer and longer between attempts.

Confirm

appLock.confirm · also shown as “Confirm PIN”

Type the same code again, to catch a typo before you lock yourself out.

Unlock with fingerprint or face

appLock.biometric · Phone only

Open the app with the phone’s fingerprint or face check instead of typing the PIN. Type your current PIN above first, then turn this on.

• Default: Off.
• Caution: To make this work the PIN is kept in the phone’s secure storage (iOS Keychain, Android Keystore) and read by the app after a successful biometric check. Turning this off, or disabling the lock, removes it.

PIN

lock.code · also shown as “Passphrase”

The code you chose for the app lock. Sessions keep running while the app is locked.

• Caution: After 5 wrong tries the app makes you wait, 30 seconds at first and twice as long each time.

New passphrase

lock.createPassphrase · Desktop only

Everything Sternway saves on this computer is encrypted with a random key, and that key is normally kept by the system keychain (macOS Keychain, Windows DPAPI, the Linux keyring). This computer has none the app will trust: no keyring, or only the unprotected “basic” store. So the key is encrypted with a passphrase you choose instead, never stored unprotected. At least 8 characters and not digits only. You type it each time the app starts; it is also the app lock, and it can be changed but not turned off.

• Caution: It cannot be recovered. Without it the data on this device cannot be opened.

Confirm passphrase

lock.confirmPassphrase · Desktop only

Type the same passphrase again, to catch a typo.