> ## Documentation Index
> Fetch the complete documentation index at: https://docs.termique.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & encryption

> How Termique protects your credentials and what the master password does.

Termique uses end-to-end encryption. Your credentials are encrypted on your device before they are stored locally or synced. The Termique servers never see plaintext passwords or private keys.

## Master password

On first launch, you set a master password. This password:

* Is used to derive an encryption key (with a random per-user salt).
* Never leaves your device.
* Is never sent to any server.
* Cannot be recovered if lost. There is no reset mechanism.

Store it in a password manager. You can change it later from **Settings → Security**.

<Frame>
  <img src="https://mintcdn.com/termique/YQ5DIIiD1qCX4qrg/images/settings.png?fit=max&auto=format&n=YQ5DIIiD1qCX4qrg&q=85&s=96c94c210eeb3419bde4e66490a755c5" alt="Settings Security tab showing account, master password, and Touch ID" width="3136" height="2080" data-path="images/settings.png" />
</Frame>

## Data Encryption Key (DEK)

At setup, Termique generates a random DEK. The DEK is:

* Wrapped (encrypted) using the key derived from your master password.
* Stored locally and, if sync is enabled, in the API backend as an encrypted blob.
* Used to encrypt every credential (SSH passwords and private keys) before storage.

When you unlock the app with your master password, the DEK is unwrapped and held in memory. It is never accessible outside the app's secure layer.

## Credential encryption

Every credential stored by Termique is encrypted using the DEK. Encryption is performed before the credential reaches any storage layer, local or remote. The app does not retain plaintext credentials after the encryption step.

## Unlock flow

1. You enter your master password in the unlock screen.
2. Termique derives the encryption key using your stored salt.
3. The wrapped DEK is fetched from local storage (or the backend on a fresh install) and unwrapped.
4. A verification blob is checked to confirm the master password is correct before proceeding.

If the master password is wrong, the DEK cannot be unwrapped and no credentials are accessible.

<Frame>
  <img src="https://mintcdn.com/termique/YQ5DIIiD1qCX4qrg/images/unlock.png?fit=max&auto=format&n=YQ5DIIiD1qCX4qrg&q=85&s=b68bfd9c0fb9ab4856de4c5e9b93ec28" alt="Unlock screen prompting for the master password" width="3136" height="2080" data-path="images/unlock.png" />
</Frame>

## Failed attempts

After 5 failed unlock attempts, Termique locks the unlock screen for 5 minutes. This applies regardless of which device or password you're trying. It protects against brute-force guessing of your master password.

<Frame>
  <img src="https://mintcdn.com/termique/YQ5DIIiD1qCX4qrg/images/lockout.png?fit=max&auto=format&n=YQ5DIIiD1qCX4qrg&q=85&s=1fa780174ac8bf939d30fad26677d046" alt="Lockout screen showing a countdown after too many failed attempts" width="3136" height="2080" data-path="images/lockout.png" />
</Frame>

## What Termique stores server-side

| Data                     | Stored as                                                    |
| ------------------------ | ------------------------------------------------------------ |
| Hosts, groups, snippets  | Plaintext (non-sensitive metadata)                           |
| SSH passwords            | Encrypted ciphertext                                         |
| SSH private keys         | Encrypted ciphertext                                         |
| Wrapped DEK              | Encrypted ciphertext (wrapped with your master password key) |
| Salt + verification blob | Stored to enable unlock on new devices                       |

Termique's servers cannot decrypt credentials. They store and return ciphertext.

## Locking the app

Locking the app clears the DEK from memory. Credentials cannot be accessed until you unlock again with your master password.