Data key and encrypted secrets

The data key (DK) is a random 256-bit key created by Desktop. It is separate from your account password and encrypts connection secrets and supported private sync payloads with AES-256-GCM.

What it protects

• Connection passwords, SSH passphrases, and related sensitive fields stored for work
• Supported encrypted synchronization payloads

It is not full-disk encryption, and non-secret list metadata such as names or hosts may remain readable for device and resource management.

Back up the 78-digit code

Desktop can export the 32-byte key as a fixed-width 78-digit decimal code. Store it offline like a password-vault recovery seed. Do not send it through chat, email, issue trackers, or a shared drive.

Move it to another Desktop

Prefer a one-time device transfer from a Desktop that already has the key. The cloud relays ciphertext it cannot open. The receiving Desktop uses the one-time transfer code; if it already has a key, replacement requires confirmation. Importing the 78-digit backup is the recovery path.

Use the App only as an optical relay

The App can temporarily show a scanned transfer QR for another Desktop to scan. It does not import, store, or decrypt the DK.

Where it is stored

On Windows, Desktop prefers Credential Manager and keeps a local fallback file. On macOS and Linux, it uses a permission-restricted local file rather than Keychain or Secret Service. The key is also cached in process memory while needed.

Rotate carefully

Rotation first re-encrypts protected local data, then distributes the new key to other devices one at a time. A device that already has a key must confirm replacement; there is no silent fleet-wide overwrite.