How Lockra protects your accounts

This page explains how Lockra keeps your accounts safe, what each security setting does, and what it cannot protect against.

The master password

All accounts are kept in one file, encrypted with a key that Argon2id derives from your master password using 64 MiB of memory and three passes, so trying passwords one after another is slow. The file is encrypted with XChaCha20-Poly1305; if any part of it is changed, even one byte, Lockra refuses to open it instead of reading altered data.

After three wrong passwords in a row, each further attempt has to wait, starting at one second and doubling up to 30 seconds.

The master password cannot be recovered. If it is lost, Forgot the master password? on the unlock screen resets the vault after you type RESET to confirm: Lockra starts over with an empty vault and keeps the old file under a new name, which still cannot be opened without its password.

To change it, open Settings › Security › Change master password. Earlier backups keep opening with the old password.

Remember on this device

Settings › Security › Remember on this device keeps a key in the system keychain (Credential Manager on Windows, Keychain on macOS, the Secret Service on Linux), so the vault unlocks without the master password on this computer. Anyone who can sign in to your account on the computer can then open the vault, so use it only on a computer that only you use.

Turning it off asks for the master password, deletes the key from the keychain and re-encrypts the vault, so the deleted key opens nothing afterwards.

Touch ID and Windows Hello

Available Available from version 0.5.0.

On a Mac with Touch ID, or a Windows PC with Windows Hello, turn on Settings › Security › Unlock with Touch ID (Unlock with Windows Hello on Windows). Turning it on checks once that it works and turns Remember on this device on with it. The unlock screen then shows Unlock with Touch ID (or Unlock with Windows Hello): your fingerprint, or Windows Hello's fingerprint, face or PIN, is checked before the remembered key opens the vault. Until it is on, the unlock screen of a computer that has Touch ID or Windows Hello says where to find the switch. Turning it off asks for the master password and leaves Remember on this device on. The master password always unlocks.

On Windows, if Windows Hello becomes unavailable at the moment you unlock (for example while another app shows its own Windows Hello prompt), Windows asks for your Windows sign-in password instead.

The check guards against someone using your unlocked computer. A program running as you could still read the remembered key from the keychain, as without the check.

Default unlock

Available Available from version 0.7.0.

Once Unlock with Touch ID (or Unlock with Windows Hello) is on, Settings › Security › Default unlock chooses what the unlock screen does first. With Touch ID (Windows Hello on Windows), the default, its button comes first and the unlock screen asks for the check by itself: when Lockra starts, when it locks by itself while its window is in front, and when you come back to its window while it is locked. After you lock it yourself, or cancel the check, it asks again once you have left the window and come back. It never asks while Lockra is in the background. With Master password, you type the password first and the check waits for its button.

Fingerprint on Android

Available Available from version 0.7.0.

On the phone, Settings › Security › Unlock with fingerprint keeps the vault's key in the phone's secure hardware, usable only for ten seconds after a passed fingerprint check. Turning it on checks once; turning it off asks for the master password and deletes the key. A fingerprint enrolled afterwards makes the key unusable: the master password unlocks, and the switch can be turned on again. With Default unlock on Fingerprint, opening Lockra or coming back to it asks for the fingerprint by itself. Lockra is always kept out of screenshots on the phone, and leaving the app locks the vault.

Fingerprint by default

Available Available from version 0.7.1.

On a phone with an enrolled fingerprint, Unlock with fingerprint on the welcome page is on when you create a vault, restore one from a backup or join a sync space: one fingerprint check once the vault is open turns it on. Turning that switch off leaves it off, and Lockra does not ask again. An existing vault unlocked with the master password asks once whether to turn it on; after Not now this phone does not ask again, and the switch stays in Settings › Security.

The fingerprint instead of the master password

Available Available from version 0.8.6.

With Unlock with fingerprint on, the phone takes the fingerprint wherever it asked for the master password again: showing a secret (Show secret…), exporting accounts, showing the recovery key, inviting another device, changing the storage settings, and joining a sync space from an invitation or a pairing link. With Default unlock on Fingerprint, the pages that show a secret, the recovery key or an invitation ask for the fingerprint as they open; the export, storage and join pages have more to fill in, so leave the master password empty there and the fingerprint is asked when you submit. After a cancel, type the master password instead.

The fingerprint only confirms that it is you; it changes no encryption. So anyone whose finger is enrolled on the phone can show secrets, export the accounts or add the vault to a sync space there: enrol only your own fingers. Creating a vault, changing the master password, turning the fingerprint off, starting sync and recovering with the recovery key still need the master password. Joining a space with the fingerprint has one more thing to know: The fingerprint instead of the master password on the phone.

Locking

Lockra locks after five minutes without a key press or click (Settings › Security › Auto-lock: 1 to 60 minutes, or never), and at once with Ctrl L or Lock in the sidebar. Locking removes the decrypted accounts from memory and closes any open import or export.

The clipboard

A copied code is cleared from the clipboard after 30 seconds (Settings › Security › Clear clipboard: 10 to 90 seconds, or never), and only if the clipboard still holds it. On Windows the code is kept out of the clipboard history, the cloud clipboard and clipboard monitors; on macOS and Linux it is marked to stay out of clipboard history, which clipboard managers that support the mark respect.

Secrets on screen

Showing an account's secret (Show secret…) and showing export codes both ask for the master password again (on a phone with fingerprint unlock on, the fingerprint will do: see The fingerprint instead of the master password), and both hide after two minutes. While they are shown, Windows and macOS exclude the window from screenshots and screen recording. Linux has no such control: the reveal view says so, so mind screen sharing.

Settings › Security › Hide codes shows dots instead of codes until you point at an account.

A login's password follows the login's protection level (Logins).

Logins

Available Available from version 0.10.0.

Logins are encrypted in the vault with the accounts, under the same master password. Their passwords, notes, hidden fields and earlier passwords are shown only when you ask, and hide again after two minutes; meanwhile Windows and macOS keep the window out of screenshots and screen recordings. Each login's protection level decides what showing and copying ask for:

• Fill directly asks for nothing: the password of such a login is as easy to show in Lockra as it is to fill.
• Verify first asks for the master password, or Touch ID, Windows Hello or the fingerprint where Lockra unlocks with it, before a secret shows, is copied or is filled.
• Not for the extension keeps the login away from the browser extension altogether.

Copied passwords are handled as copied codes: kept out of clipboard history where the system allows, and cleared after the time in Settings › Security › Clear clipboard. The generator's history opens only after the master password, Touch ID or Windows Hello, and stays on the device (Generated passwords).

The browser extension

Available Available from version 0.10.0.

The browser extension is trusted with no more than it needs:

• One computer. It reaches Lockra on the same computer only, through the browser's native messaging, over a connection encrypted end to end between the two: a program that gets in between can break the connection, not read it.
• Pairing. Lockra and the extension show the same six-digit code only when they are connected to each other directly. Compare it before you approve, with the master password, Touch ID or Windows Hello; a request lasts two minutes.
• Locked means nothing. While Lockra is locked, the extension gets nothing, and locking ends every connection.
• Lockra decides. It offers only the logins that match the address the browser reports for the form, never what the page claims; fills nothing in a frame of another site unless you let it ask first; asks before an https:// login goes into an http:// page; and waits for your proof for a login set to Verify first.
• Limits. An extension that asks too often is paused until you resume it in Settings › Browser.
• Its permissions stay in the vault. What the extensions may do is kept in the vault, so editing a settings file cannot widen it, and every change that lets them do more asks for the master password, Touch ID or Windows Hello. Filling as pages load is off until you turn it on.
• Clicks in the page. Lockra's menu and prompts in a page take a click only once they have been visible, uncovered and still for at least 300 milliseconds, so a page cannot trick you into clicking them.

With Keep running after the window closes on, the vault stays unlocked behind the closed window until it locks by itself or you lock it from the tray.

Sync

Sync (from version 0.4.0) is off until you set it up, on storage of your own or a Lockra relay. Everything a device writes there is encrypted on the device, and from the storage the key that encrypts it opens only with both the master password of a device in the space and the recovery key. An invitation carries that key itself, so a device that has one joins without a password: Lockra shows it only after the master password or Touch ID, Windows Hello or the fingerprint, and hides it after two minutes. A space on a relay copies a pairing link that does not expire, and a device that has it joins without a password too. Each device writes only its own file, so devices never overwrite each other's changes; a file that was altered or put back to an older version is refused. The storage's credentials and the recovery key are kept in the encrypted vault and never in a backup. Sync between devices explains what the storage can see.

Through a Lockra relay

Available Available from version 0.8.1.

A Lockra relay you run is storage like any other and is trusted with no more: it keeps the same encrypted files, and neither the key that encrypts them nor the recovery key reaches it. The devices identify themselves to it with a value made from the recovery key, from which the recovery key cannot be recovered, so nobody else can read or change the space there. If the relay's disk is taken, or its operator is made to hand over what it keeps, all anyone gets is these encrypted files and the fingerprint of that value: opening the files takes the recovery key together with a device's master password, or the key in an invitation, and those are on your devices only, not on the relay or with its operator. The relay sees when and from which network addresses the devices sync, and it can delete the space or be unavailable; the devices keep every account either way (Through a Lockra relay).

What Lockra cannot protect against

• Malware running as your user on the computer can read what you type, including the master password.
• With Remember on this device on, the vault is as safe as your account on the computer.
• A forgotten master password cannot be recovered, by anyone.
• A login set to Fill directly shows its password to anyone at your unlocked computer.
• Malware running as your user can copy the browser extension's key out of the browser's profile and act as the paired extension, within its limits and the logins' protection levels.
• A malicious script on a site a login matches, any subdomain of its domain included, can read what the extension fills there; with filling as pages load, it needs no click from you.
• Passwords the extension fills pass through the browser's memory, which Lockra cannot wipe.
• Some Linux desktops show no tray icon: there, nothing shows that Lockra still runs, unlocked, in the background.
• With sync on, someone who photographs an invitation, gets a relay space's pairing link, or gets an invitation's text and its code, joins the space; a pairing link works until you start a new sync space. Someone who has both the storage's contents and the recovery key can try master passwords on their own computer, against every device's; a long master password on every device is the defence. Whoever can write to the storage can delete the space, which stops sync but not your vaults. Removing a device does not revoke it.

For the full design, see the security model.