Keys and backups

Your identity is a set of keys, kept encrypted on this computer together with your ledgers and settings, and opened with your passcode. How much you can bring back after changing or losing a computer depends on the backups you made beforehand.

Three things to keep safe

Keep the recovery words away from the computer, the backup file on another disk, and the backup password written down somewhere else.

Passcode and locking

• The passcode is 8 letters or digits, case-sensitive. One that is too simple (eight identical characters, a run of digits, something like a date) is refused.
• After 5 wrong tries in a row the passcode gate locks, and the way on is “Recover”: with the primary identity’s recovery words or key file, or a whole-machine backup.
• “Lock” in the sidebar, or ⌘L (Ctrl+L on Windows and Linux), locks at once. After 15 idle minutes the app locks on its own; change the time in Settings › Identity key.

A forgotten passcode

On the passcode gate, press “Forgot passcode”, fill in the 12 recovery words of this computer’s primary identity (by default the first one made here); or open “Recover with a key file”, choose a key file exported from either role of the primary identity and enter its password. Then set a new passcode. You can also press “Restore from backup” and restore from a whole-machine backup.

Whole-machine backup

1. Open Settings › Local data and press “Export backup”.
2. Set a backup password (at least 8 characters) and enter it again, enter your passcode, and press “Export”. It saves to the last folder used; “Choose folder” changes it.

One file restores the identities, ledgers and settings of the whole computer. While it exports, the dialog shows “Collecting”, “Encryption”, “Writing” and “Reading back” in turn, and closes once the check passes and it says “Backup exported”; that is when the backup counts. To see where your backups stand, look at “Last backup” at the top of Settings › Local data: it gives the time of the last one, or “Never”; when new records have come since, it adds how many and turns amber. The “Whole-machine backup” row of “Setup check” on the About page carries “Export backup” until the backup is up to date.

To restore, press “Restore from backup” in Settings › Local data, choose the backup file, and enter the backup password and this computer’s passcode. Afterwards this computer holds what the backup holds, and “With a credential” is off; turn it on again when you need it.

When the key store cannot be read at start, the lock screen gives the reason and the file’s path. Below it, “Move this machine’s data aside and start over” moves the whole local data folder aside as it is, with every byte kept, and opens the first-run wizard, where you restore from a whole-machine backup; without a backup, the recovery words or a key file bring the identity back.

Several identities

Click the identity chip at the top of the sidebar to open “Switch identity”: switch, or use “New identity” or “Import key”. Each identity has its own keys, network and ledgers.

A key used elsewhere starts read-only once imported: the app compares its records on chain with the ledger here, and writing opens once they line up. When they differ, fetch the ledger from that computer’s whole-machine backup with “Fetch ledger”, or take over that ledger’s folder or ledger mirror with “Adopt existing ledger folder” under “Advanced options” in Settings › Local data.

Under “Details” in Settings › Identity key, the row below the key address is “Public key”, with a copy key beside it. When someone wants to encrypt a record kit to you, send them this; see For one person’s eyes.

Moving to a new key

If you fear a key has leaked, or want someone else to carry on the ledger, use Ledger › More › “Key handover”: fill in the new key’s address, confirm, and put it on chain. From then on the new key writes this ledger, and this computer reads it.

Using your identity key safely

• Keep only a little ETH at its address, enough for gas; keep other assets at other addresses.
• Sign with it in Zikaron alone. Signing requests from other websites or apps belong to another wallet.
• One key writes one ledger.

Where your data lives

Ledgers, settings and received grants are kept encrypted on your computer and open with your passcode; the language and appearance the passcode gate needs, and the list of read-only networks, are kept in plain on this computer; exported record kits, grant files and credentials (for showing a grant) are ordinary files, ready to hand to others. To move it elsewhere, use “Move to an empty folder” under “Advanced options” in Settings › Local data. When the same data sits on a synced disk with two computers open, one of them writes; the other shows a bar at the top, and “Write from this machine” moves writing to it.