Lock and idle timeout

When you step away, your decrypted secrets shouldn't stay on the screen or in the page's memory. Locking makes the web app forget your keys and remove decrypted data from the page. Your device stays signed in, so you only need your password to continue.

Lock by hand

Choose Lock at the bottom of the sidebar. The page switches to Locked and says Vault locked. Decrypted data has been removed from the page. To continue, enter your password and choose Unlock. Sign in with another account switches accounts instead.

Lock after inactivity

The web app locks itself after a period without activity. Set it in Account, then Security, under the idle lock setting: 1, 5, 10, 15, 30 or 60 minutes. The default is 10 minutes.

• The setting belongs to this browser. Set it on each device you use.
• A minute before locking, a banner warns you. If you have unsaved changes, they'll be lost when the page locks, so save them first.
• After locking, the page says Vault locked due to inactivity.

While the Emergency Kit is on screen during sign-up, the page doesn't lock itself, because locking would wipe the sheet with your new Secret Key. Don't leave that page unattended.

Sessions on the server

Locking is about your keys in the page. Separately, the server limits how long a sign-in session lasts:

• a session ends after 12 hours without activity;
• a session lasts at most 7 days.

When the server session ends, the app locks and asks you to sign in again. You can see and end sessions in Account, under Devices and sessions: one at a time, or all at once.

A stolen but still open session gets only what the server allows during that session. It can't change your password, your Secret Key or your keys, and it can't delete your account, because those actions need a signature made from your current password and Secret Key.

The clipboard

When you copy a value, Crunu clears the clipboard after a minute if your value is still on it and the tab is active. If you switch tabs, the clipboard is left alone unless the browser lets the page read it, because it might hold something you copied elsewhere.

In the terminal

crunu signed in as you keeps your keys in a separate key holder process in memory, not on disk:

• right after crunu login, for 1 hour;
• after crunu unlock --ttl 2h, for the time you set, up to 12 hours;
• crunu lock forgets them at once.

When the time runs out, the key holder closes its server session and exits. See Sign in from the terminal.

Locked is not the same as blocked

• Locked means your own app forgot your keys. Enter your password to continue.
• Sign-in temporarily blocked means the server stopped accepting sign-in attempts after too many failures: 10 failures from one address or 5 for one account within 15 minutes. Wait and try again. The server answers the same way for a wrong password and an unknown account.

If a device is lost or stolen

Locking protects a device that is left unattended. If it's gone:

1. From another device, open Account, then Devices and sessions, and end the lost device's sessions and remove it.
2. If the device was stolen, use Device compromised… in Account, then Security. It creates new account keys, a new password and Secret Key, signs out every other device and rotates every environment where you had a key.

See Emergency Kit and Secret Key.