On this page

Backup Dongles

Pro tier users can create backup dongles — additional USB drives that contain copies of your master dongle's encryption key. Each backup functions identically to your primary dongle: it can encrypt, decrypt, create vaults, and perform all operations. This page explains how to create, manage, and revoke backup dongles.

Why Create Backups?

Your hardware dongle is the only thing that can decrypt your files. If it's lost, stolen, or damaged, your encrypted data becomes permanently inaccessible — there is no server-side recovery mechanism.

Backup dongles protect against:

Risk Protection
Dongle failure Hardware degrades over time; backups provide redundancy
Loss or theft A backup stored in a separate location means you still have access
Travel Keep a backup at home while carrying another
Safe deposit Store a backup in a bank safe for disaster recovery

Danger

If you lose all copies of your dongle (primary and all backups), your encrypted data is permanently lost. There is no recovery mechanism. Create at least one backup and store it in a separate physical location.

Limits

Rule Value
Maximum active dongles per account 5 (including the primary)
Minimum active dongles per account 1 (cannot deactivate the last one)

How Backups Work

A backup dongle is an exact copy of your master dongle's encryption key:

  • Same encryption key — any backup can decrypt files encrypted by any other dongle in the set
  • Unique device ID — each physical device is individually tracked for management and revocation

Because all dongles share the same encryption key, any active dongle can decrypt files encrypted by any other dongle in the set.

Creating a Backup — Single-Port Wizard

The backup dongle wizard is designed to work with a single USB port. You don't need two ports or a USB hub.

Before You Start

  • Ensure your primary dongle is available
  • Have a blank USB drive ready for the backup
  • Confirm you have fewer than 5 active dongles (check in account settings)

Step 1 — Plug In Master

Insert your primary dongle. The wizard detects it and displays its name. Click Read to cache the key material in memory.

Step 2 — Unplug Master

After the key material is cached, unplug the master dongle. The wizard waits for the removal before proceeding.

Step 3 — Plug In Blank USB

Insert the target USB drive. The wizard inspects it:

  • If the drive already has a key file from a different account — the wizard refuses
  • If the drive has other files — a warning is shown asking for confirmation

You're prompted for an optional label for the backup (e.g., "Office safe", "Bank vault", "Travel spare").

Step 4 — Write and Register

Click Create Backup. The wizard:

  1. Writes the encryption key to the new USB drive with a unique device identifier
  2. Optionally copies your current vault configuration
  3. Registers the backup with your account
  4. Confirms success

Tip

The key material is held in RAM only during the wizard and is securely cleared when the wizard completes or is cancelled. It is never written to your computer's disk.

Managing Dongles

You can view and manage your dongles from two places:

  • Website: Account settings → "Your Dongles" panel
  • Desktop app: Settings → Account panel

Dongle List

The dongle list shows:

Column Description
Label User-assigned name (e.g., "Primary", "Office safe")
Dongle ID Masked device identifier
Status Active or Deactivated
Registered Date the dongle was first registered
Last verified Date the dongle last checked in with the server

Renaming a Dongle

Click Rename next to any dongle to update its label. This is cosmetic only — it doesn't affect the dongle's function.

Deactivating a Dongle

If a dongle is lost, stolen, or no longer needed, you can deactivate it:

  1. Open your dongle list (website or app)
  2. Click Deactivate next to the target dongle
  3. Confirm in the warning modal

Warning

Deactivation is immediate and effective on the next app launch using that dongle. The server rejects deactivated dongles during verification. There is no grace period.

Restrictions:

  • You cannot deactivate your last active dongle — at least one must remain active at all times
  • You cannot deactivate a dongle owned by another account

Deleting a Deactivated Dongle

After deactivation, the dongle entry remains visible (with Deactivated status) for your records. You can optionally delete deactivated entries to clean up the list.

Revocation and Security

When you deactivate a dongle:

  • The server marks it as deactivated
  • The next time someone tries to use that dongle, the app contacts the server and refuses to unlock
  • Deactivation does not re-encrypt your files — the key material itself is unchanged

This means:

  • A stolen dongle can still be used offline until the app contacts the server
  • For maximum security after a dongle loss, deactivate immediately and consider re-encrypting critical files

Note

For maximum security after losing a dongle, deactivate it immediately from your account, then consider re-encrypting critical files using a remaining active dongle.

Using Different Dongles

Each dongle maintains its own vault configuration independently. When you use a different dongle than usual, the app will automatically reconstruct its vault list from configuration snapshots stored at your vault locations. This is seamless — you'll simply see the vault list rebuild the first time you use a different dongle.

Further Reading