Locking
Claspt has two locks, and they answer two different questions: who can see the vault on this screen, and whether the key is in memory at all.
Screen lock
Section titled “Screen lock”After a period with no activity in the Claspt window the app locks its screen: the current page is saved, revealed secrets are collapsed, the clipboard is cleared of anything copied from a secret, and the unlock screen appears. Set the time under Settings › Security › Locking › Auto-lock; fifteen minutes to start.
The tools you have connected keep working behind a locked screen: the browser extension still fills, an agent mid-task still reads what you have approved. Whether they can is decided by the key lock, not the screen.
Key lock
Section titled “Key lock”The key lock clears the master key from memory after a period with no activity anywhere, including from tools. Once it fires, every request is refused until you unlock, and the browser extension, the CLI and every agent say the vault is locked. Set it under Settings › Security › Locking › Key lock; it is off until you set a time.
A tool at work counts as activity, so an agent in the middle of a long job is not cut off; it is cut off when nothing has happened for the time you chose.
Locking by hand
Section titled “Locking by hand”Cmd+Shift+L on macOS, Ctrl+Shift+L on Windows and Linux, or the lock icon
in the sidebar. A manual lock is a screen lock and a key lock at once.
Unlocking
Section titled “Unlocking”Type the master password, or use a fingerprint or face if biometric unlock is on. Your page and cursor are where you left them.
What is cleared, plainly
Section titled “What is cleared, plainly”- Key material (the master key, the keys derived from your password, sync and recovery keys) is wiped from memory when the key lock fires and on a manual lock.
- Decrypted secret values shown on screen are collapsed and dropped, but Claspt does not scrub every copy of a value from process memory; the design note in the public repository explains why. The lock clears the key, which is what stops anything new from being decrypted.
- Wrong password guesses are counted and met with growing delays, and the count survives a restart.
Recommendations
Section titled “Recommendations”- Five minutes for the screen if you keep production keys; fifteen if Claspt is a daily reference tool.
- Set a key lock if you leave agents running: an hour keeps a working agent going and clears the key overnight.
- Pair both with your operating system’s screen lock.