How to Lock/Unlock Your Session

Learn how PopaDex's automatic session locking protects your encrypted data

What is Session Locking?

When you enable End-to-End Encryption (E2EE), PopaDex implements a two-tier session timeout system to protect your data:

🔐 E2EE Session Lock (15 minutes)

Your encryption keys are cleared from memory after 15 minutes of inactivity. You'll need to re-enter your master key to decrypt your data.

🚪 Full Session Logout (30 minutes)

You'll be completely logged out after 30 minutes of inactivity. You'll need to sign in again with your email and password.

This layered approach ensures that even if you accidentally leave PopaDex open on a shared computer, your encrypted financial data remains protected.

How It Works

Activity Tracking

PopaDex monitors your activity (page views, clicks, API requests). Each action resets the 15-minute countdown.

Inactivity Warning

At 13 minutes (2 minutes before lock), you'll see a warning banner at the top of the page giving you time to save your work.

Automatic Lock

At 15 minutes, your encryption keys are cleared. Encrypted data becomes unreadable until you unlock your session.

Session Requires Re-Login

When you try to access PopaDex after the 15-minute timeout, you'll need to log in again. Your E2EE session unlocks automatically during login.

Unlocking Your Session

When your E2EE session locks due to inactivity, unlocking is automatic and seamless - there's no separate unlock step required.

How Automatic Unlock Works:

During Login

Your master key is automatically unlocked when you log in with your account password. PopaDex securely stores your password temporarily (in memory only) and uses it to unlock your encryption keys immediately after login.

While Active

Your encryption keys remain in memory (RAM) as long as you're actively using PopaDex. They're never written to disk.

After Session Lock

When the 15-minute timeout triggers, your encryption keys are cleared from memory. The next time you refresh the page or navigate, you'll simply need to log in again with your account password - PopaDex automatically unlocks your E2EE session.

✨ The Best Part: No Extra Steps

Unlike other encrypted services, you don't need to remember a separate "master password" or go through a separate unlock flow. Your PopaDex login password is all you need - encryption unlocking happens automatically in the background.

Security Best Practices

Use a Strong Password

Since your account password unlocks both your account and your encryption keys, choose a strong, unique password. Use a password manager if possible.

Save Your Recovery Key

Store your recovery key in a secure location (password manager, encrypted file, safe). You'll need it if you ever lose access to your account.

Sign Out on Shared Devices

On shared or public computers, always fully sign out when you're done. This is more secure than relying on the timeout.

Trust the Timeout

The 15-minute auto-lock is intentionally aggressive. It may feel inconvenient, but it significantly improves security by clearing your encryption keys from memory.

Troubleshooting

❓ My session locks too frequently

The 15-minute timeout is a security feature and cannot be extended. However, any activity (clicking, typing, page navigation) resets the countdown.

Tip: Keep the tab active while working to avoid locks. If your session does lock, simply refresh the page and log in again - unlock is automatic.

❓ I didn't receive a warning before lock

The warning appears at 13 minutes. If you have ad blockers or script blockers enabled, they may interfere with the warning banner.

Solution: Whitelist PopaDex in your browser extensions.

❓ I can't access my data after the timeout

After a timeout, your encryption keys are cleared from memory. To access your data again, simply refresh the page or navigate to another page within PopaDex.

What happens: You'll be prompted to log in with your account password, and your E2EE session will automatically unlock in the background.

❓ Session locks even when I'm active

This could indicate a browser or network issue preventing activity tracking from working properly.

Try: Refresh the page, clear your browser cache, or try a different browser. If the problem persists, contact support.