Lock Filarr

Hide Filarr behind a lock screen: PIN, lock on demand, auto-lock, enhanced lock and hardware security key, on the desktop and on the web.

On this page
Documentation sections

Locking hides Filarr behind a screen until you prove it is you. It is useful when you step away from your computer, or when other people use it. Filarr gives you several tools: a PIN, a lock you trigger yourself, an automatic lock after inactivity, an enhanced lock and a hardware security key.

What the PIN does, and what it does not

The PIN is a code of 4 to 6 digits. Filarr asks for it each time the profile opens, and when you come back after a lock.

The PIN encrypts nothing. Your password is what protects your files. In the desktop app, Filarr keeps your encryption key on this computer, sealed by the system for your user account, so that the profile can open without your password. The PIN decides who gets past Filarr's screen. It does not change how your files are protected.

If other people can use your session on the computer, add the Enhanced lock described below: Filarr then asks for your password at every launch.

Set up, change or remove a PIN

  1. Click your avatar at the top right, then Profile.
  2. In the PIN Lock section, click Set up a PIN, or Change PIN if you already have one.
  3. To change a PIN, enter the Current PIN first.
  4. Type the New PIN and the Confirm PIN, then confirm with the button below them.

You can also choose a PIN when you create a profile, with PIN protection. To remove it, click Remove PIN in the same section.

Once a PIN exists, the Allow PIN reset switch appears. When it is on, Forgot PIN? on the PIN screen of the profile picker removes the PIN with your encryption password, then lets you choose a new one. The lock screen you see after Lock or an auto-lock has no such link. When the switch is off, or the profile has no encryption password, a forgotten PIN cannot be recovered. Keep it on for a local profile: the same screen of the profile picker leads to the 12-word recovery, see Passwords and recovery.

After several wrong attempts, Filarr makes you wait before you can try again: 15 seconds after three failures in the profile picker, then longer each time, and 30 seconds after five failures on the lock screen.

Lock Filarr now

  1. Click your avatar at the top right.
  2. Click Lock, at the top of the menu.

Filarr shows the lock screen. To come back, enter your PIN if the profile has one, otherwise your vault password. The password screen also says why Filarr locked, here Lock requested.

Lock only appears when Filarr has a way to let you back in: a PIN, or your key. In the desktop app, you can also lock from anywhere with Ctrl+Alt+Shift+L, or with Lock everything in the notification area menu. Desktop protection and the mini vault covers these, along with locking when your computer session locks or goes to sleep.

Auto-lock

  1. Open Settings → Security.
  2. In Auto-lock, pick a delay: Never, After 1 min, After 5 min, After 15 min, After 30 min or After 1 hour.

Never is the default. After the chosen time without activity, Filarr locks. The password screen then says Locked after a period of inactivity. When the lock comes from your computer instead, for example Win+L or sleep, the screen says Lock requested.

If you belong to an organization, it can impose a shorter delay. Filarr then applies the shorter of the two.

Enhanced lock

By default, the desktop app keeps your key between two launches, so you do not type your password each time. Enhanced lock changes that: Filarr deletes the local key when it closes, and asks for your vault password at every launch.

  1. Open Settings → Security.
  2. Turn on Enhanced lock. Filarr shows Recommended on shared devices.

At the next launch, the lock screen explains: "Enhanced Lock: this vault's key is never kept on this device between sessions." If the profile also has a PIN, Filarr asks for the PIN in the profile picker, then for the password.

Hardware security key

A hardware key lets you unlock the vault by touching a security key instead of typing your password.

  1. Unlock Filarr, then open Settings → Hardware security key.
  2. Click Enroll a key.
  3. When Filarr shows Touch your key…, follow your system's prompt and touch the key.

Filarr then shows A security key is enrolled on this device. From now on, the password lock screen offers Use my security key.

Filarr lists YubiKey 5 and later, and Windows Hello. The key must support an extension called PRF (or hmac-secret), otherwise enrollment fails. Enrollment belongs to this device: enroll the key again on each device where you want to use it.

The key is a shortcut, not a replacement. Your vault password always keeps working. To stop using the key, click Remove and confirm.

In the web app

The web app locks differently, because a browser does not keep secrets the way an installed app does.

  • Your key is not kept between visits. Each time you come back, Filarr asks for your password: "In the browser, this vault's key isn't kept from one visit to the next: your password reopens it."
  • Stay unlocked on this device (14 days). Tick this box on the lock screen, before you click Unlock, to keep the key sealed in this browser for 14 days. Only do it on a device that you alone use.
  • Lock appears in the profile menu for a profile linked to a cloud account, once its key is open. Locking makes the browser forget the key.
  • Auto-lock works the same way as on the desktop.
  • Log out, in the avatar menu, removes the key and the session from the browser.