Vault master password & app lock

Two settings are easy to confuse. They’re related but separate: one encrypts your secrets, the other gates the app on launch.

The vault master password

The first time you save something sensitive — a password, key passphrase, or private key — TermZ asks you to set a master password. That password derives the key that unlocks the credential vault; it is never stored anywhere.

Keep a backup

Because the master password is never stored, no one — including us — can recover it. If you lose it, the encrypted secrets are unrecoverable. Keep a backup somewhere safe.

You can use TermZ without ever saving a secret (type credentials each time). The vault is simply what makes saved sessions one-click.

Changing it

Changing the master password transparently re-keys the encrypted database — all your saved data is preserved. You’re not re-entering anything.

App lock

App lock is a separate, optional control: Settings → Security → “Require master password to open the app.”

When it’s on, TermZ shows a lock screen on launch, and the rest of the app never mounts behind it until you enter the master password — a configuration lock, SecureCRT-style.

Caution

Disabling app lock does not decrypt your vault, but it does mean anyone with access to your unlocked device can open TermZ and use stored credentials. Leave it on for shared or portable machines.