Device trust
What a trusted device is, how trust is established and revoked, and how trusted devices fit into the two-gate unlock model.
A trusted device is a device — today, your mobile phone — that holds its own protected copy of your vault key and can therefore unlock your vault, or approve an unlock on another device, without you re-entering your Access Key. Trust is a cryptographic property, not a server-side flag: it exists because the device holds a key wrap only it can open.
What makes a device "trusted"#
When a device becomes trusted, your master key is wrapped to a key that lives in the device's hardware-backed keystore and is only released after a biometric check. The server stores the wrapped (encrypted) copy but can never open it — this keeps device trust compatible with the zero-knowledge model.
Currently your trusted mobile is the device that approves unlocks; one trusted mobile is active at a time. The number of devices you can register overall is plan-dependent — see Plan comparison & limits.
How trust is established#
There are two paths, both ending with a device-bound key wrap:
- Mobile signup — when you create your account (or complete key setup) on the mobile app, that device is registered and trusted automatically.
- QR pairing — from a browser session with your vault unlocked, generate a pairing QR code and scan it with the mobile app. The browser wraps your master key to the phone's public key, so the key travels between your devices in sealed form only.
Trust is time-boxed, and the clock measures disuse. The window is 30 days by default and slides forward every time the device is used, so a device you use regularly stays trusted indefinitely while a forgotten one does not. You can shorten the window for your own account, and an organization can cap how long its members' devices may stay trusted.
How trust ends#
- You revoke it — in Account → Devices, revoke any device you've sold, lost, or replaced. It loses the ability to unlock or relay unlocks and must re-authenticate and re-pair.
- Trust lapses from disuse — a device that goes unused for the whole window stops being trusted and must be paired again. Using a device resets its window, so this only reaches devices you have genuinely stopped using. You are warned first: a notification a week before, and a final one the day before. Using the device is all it takes to clear it.
If a phone's trust does lapse, you can restore it on the phone itself with your Access Key — no computer required. Open the app and choose Use Access Key on the "This phone isn't trusted" prompt. It restores only that phone, and only with a freshly typed key.
Revocation is the right response to a lost or transferred phone. Combined with signing out its sessions, it removes the device's path to your vault key.
Where device trust fits in the two-gate model#
Device trust lives entirely at gate 2 of the two-gate model. It never bypasses gate 1 — you still sign in with your credentials — it only replaces typing your Access Key to unlock:
- You sign in on a browser (gate 1) and choose Unlock with trusted device.
- Your trusted phone shows an approval prompt that asks for the number your browser is displaying. The phone is not told it, so it cannot approve a look-alike request on its own.
- You type the number and pass the phone's biometric check.
- The phone seals your vault key to a one-time key the browser generated for this request; the server relays the sealed payload it cannot read.
- The browser opens the payload, unlocks the vault, and receives a normal vault session.
Requests are short-lived (about two minutes), can be denied from the phone, and are rate-limited. The full protocol is described in Trusted-device unlock.