Backup Dongles
Pro tier users can create backup dongles — additional USB drives that contain copies of your master dongle's encryption key. Each backup functions identically to your primary dongle: it can encrypt, decrypt, create vaults, and perform all operations. This page explains how to create, manage, and revoke backup dongles.
Why Create Backups?
Your hardware dongle is the only thing that can decrypt your files. If it's lost, stolen, or damaged, your encrypted data becomes permanently inaccessible — there is no server-side recovery mechanism.
Backup dongles protect against:
| Risk | Protection |
|---|---|
| Dongle failure | Hardware degrades over time; backups provide redundancy |
| Loss or theft | A backup stored in a separate location means you still have access |
| Travel | Keep a backup at home while carrying another |
| Safe deposit | Store a backup in a bank safe for disaster recovery |
Danger
If you lose all copies of your dongle (primary and all backups), your encrypted data is permanently lost. There is no recovery mechanism. Create at least one backup and store it in a separate physical location.
Limits
| Rule | Value |
|---|---|
| Maximum active dongles per account | 5 (including the primary) |
| Minimum active dongles per account | 1 (cannot deactivate the last one) |
How Backups Work
A backup dongle is an exact copy of your master dongle's encryption key:
- Same encryption key — any backup can decrypt files encrypted by any other dongle in the set
- Unique device ID — each physical device is individually tracked for management and revocation
Because all dongles share the same encryption key, any active dongle can decrypt files encrypted by any other dongle in the set.
Creating a Backup — Single-Port Wizard
The backup dongle wizard is designed to work with a single USB port. You don't need two ports or a USB hub.
Before You Start
- Ensure your primary dongle is available
- Have a blank USB drive ready for the backup
- Confirm you have fewer than 5 active dongles (check in account settings)
Step 1 — Plug In Master
Insert your primary dongle. The wizard detects it and displays its name. Click Read to cache the key material in memory.
Step 2 — Unplug Master
After the key material is cached, unplug the master dongle. The wizard waits for the removal before proceeding.
Step 3 — Plug In Blank USB
Insert the target USB drive. The wizard inspects it:
- If the drive already has a key file from a different account — the wizard refuses
- If the drive has other files — a warning is shown asking for confirmation
You're prompted for an optional label for the backup (e.g., "Office safe", "Bank vault", "Travel spare").
Step 4 — Write and Register
Click Create Backup. The wizard:
- Writes the encryption key to the new USB drive with a unique device identifier
- Optionally copies your current vault configuration
- Registers the backup with your account
- Confirms success
Tip
The key material is held in RAM only during the wizard and is securely cleared when the wizard completes or is cancelled. It is never written to your computer's disk.
Managing Dongles
You can view and manage your dongles from two places:
- Website: Account settings → "Your Dongles" panel
- Desktop app: Settings → Account panel
Dongle List
The dongle list shows:
| Column | Description |
|---|---|
| Label | User-assigned name (e.g., "Primary", "Office safe") |
| Dongle ID | Masked device identifier |
| Status | Active or Deactivated |
| Registered | Date the dongle was first registered |
| Last verified | Date the dongle last checked in with the server |
Renaming a Dongle
Click Rename next to any dongle to update its label. This is cosmetic only — it doesn't affect the dongle's function.
Deactivating a Dongle
If a dongle is lost, stolen, or no longer needed, you can deactivate it:
- Open your dongle list (website or app)
- Click Deactivate next to the target dongle
- Confirm in the warning modal
Warning
Deactivation is immediate and effective on the next app launch using that dongle. The server rejects deactivated dongles during verification. There is no grace period.
Restrictions:
- You cannot deactivate your last active dongle — at least one must remain active at all times
- You cannot deactivate a dongle owned by another account
Deleting a Deactivated Dongle
After deactivation, the dongle entry remains visible (with Deactivated status) for your records. You can optionally delete deactivated entries to clean up the list.
Revocation and Security
When you deactivate a dongle:
- The server marks it as deactivated
- The next time someone tries to use that dongle, the app contacts the server and refuses to unlock
- Deactivation does not re-encrypt your files — the key material itself is unchanged
This means:
- A stolen dongle can still be used offline until the app contacts the server
- For maximum security after a dongle loss, deactivate immediately and consider re-encrypting critical files
Note
For maximum security after losing a dongle, deactivate it immediately from your account, then consider re-encrypting critical files using a remaining active dongle.
Using Different Dongles
Each dongle maintains its own vault configuration independently. When you use a different dongle than usual, the app will automatically reconstruct its vault list from configuration snapshots stored at your vault locations. This is seamless — you'll simply see the vault list rebuild the first time you use a different dongle.
Further Reading
- USB Dongle Provisioning — initial dongle setup
- Best Practices — recommendations for dongle storage and backup strategy
- Subscription Management — manage your Pro subscription