First launch — master password¶
On first launch, korTTY asks you to create a master password. This password encrypts all stored connection passwords, SSH key passphrases and credentials using AES-256-GCM.
- Enter a password (minimum 6 characters). The field border turns green when long enough and red when too short; a strength indicator rates the quality. A weak or common password shows a warning but can still be used if you confirm.
- Confirm the password.
- Leave Share anonymous usage statistics ticked to help improve korTTY, or clear the checkbox if you would rather share nothing. It is pre-selected, but the choice is yours before you confirm — what is collected is fully anonymous and GDPR-compliant, and the setting can be changed any time in Settings → Privacy. The ? button opens Anonymous data for application optimization. An organization policy that forbids telemetry locks the checkbox and leaves it clear.
- Click Setup.
On subsequent launches you are prompted to enter the master password to unlock your encrypted data.
Disabling the prompt
Settings → Security offers two ways to skip the prompt. Turning off Require master password on startup hides the prompt and starts korTTY with the vault locked: stored passwords and keys stay unavailable until you choose Configuration → Security → Unlock Vault… or click Unlock Vault… in any "vault locked" message. Disable master password prompt on startup (auto-login) instead unlocks the vault automatically from a copy of your master password kept on disk. That copy is encrypted only with a key built into korTTY, not with your master password, so it guards against casual disclosure only; reserve this option for throwaway or test environments. See the Security settings for details, including unattended first launches that skip the setup dialog entirely.
What is encrypted¶
| Data | File | Protection |
|---|---|---|
| Connection passwords | ~/.kortty/connections.xml |
AES-256-GCM (master-password-derived key) |
| Stored credentials | ~/.kortty/credentials.xml |
AES-256-GCM |
| SSH key passphrases | ~/.kortty/ssh-keys.xml |
AES-256-GCM |
| Master password | ~/.kortty/master.key |
salted hash (verification only) |
| Remembered master password (auto-login only) | ~/.kortty/master.autounlock |
AES-256-GCM with a key built into korTTY, not your master password; owner-only file permissions |
| Restored terminal output (optional) | ~/.kortty/session/scrollback/<ref>.enc |
AES-256-GCM (master-password-derived key); written only while Also restore the output of each terminal pane (encrypted) is enabled under Settings → Window → Session Restore, and nothing is written while the vault is locked |
See the Security reference for the full encryption and backup model.