Vault and security
Encryption
The master password goes through Argon2id on the device. Out come an authentication key (the server receives a hash of it) and a vault key that never leaves the device. Every item of the vault (host, key, identity, snippet, database connection) is sealed with XChaCha20-Poly1305 before it leaves for sync.
The server can neither read your hosts nor reset your password.
Recovery key
Shown once at account creation. It alone recovers the vault if the password is lost. It can be regenerated under Settings › Account. Without the password and the recovery key the data is lost: by design.
Two-factor authentication
Settings › Account › Two-factor authentication: TOTP with backup codes. It is required to add a second device, for the remote terminal and for the Claude connector. Sign-in to app.konsolity.com and admin.konsolity.com asks for it too.
App lock
Settings › Security: Face ID, Touch ID or master password when the app comes back to the front, with the content masked. On desktop, quick unlock through the system keychain is offered.
SSH keys
Private keys stay encrypted in the vault; an internal agent signs for sessions without ever handing the key over. Connection logs are redacted: never a password, a key or the text of a command.
Devices
Settings › Account › Devices, or app.konsolity.com: every device, its platform, last activity, country. Revoking a device signs it out and removes its keys everywhere.