How to Lock/Unlock Your Session
Learn how PopaDex's automatic session locking protects your encrypted data
What is Session Locking?
PopaDex uses server session timeouts and a separate device crypto session. Their timers and stored credentials have different lifetimes.
Inactivity lock
Server inactivity checks can lock access. Device keys and server sessions have separate lifetimes; a lock is not proof that every stored key has been erased.
Full Session Logout (30 minutes)
You'll be completely logged out after 30 minutes of inactivity. You'll need to sign in again with your email and password.
Always sign out when finished on a shared device. An unlocked device or malicious software can still read displayed data.
How It Works
Activity Tracking
PopaDex monitors your activity (page views, clicks, API requests). Each action resets the 15-minute countdown.
Inactivity Warning
At 13 minutes (2 minutes before lock), you'll see a warning banner at the top of the page giving you time to save your work.
Automatic Lock
After an inactivity lock, you may need to sign in and unlock encrypted fields again. Stored credentials and native Keychain behaviour vary by flow.
Session Requires Re-Login
Sign in again when prompted. Password accounts may unlock using the original password; OAuth vault and native Keychain flows have separate unlock requirements.
Unlocking Your Session
Sign in again when prompted. Password accounts may unlock using the original password; OAuth vault and native Keychain flows have separate unlock requirements.
How Automatic Unlock Works:
During Login
Current password accounts derive separate login and financial wrapping credentials in the browser. Older accounts keep their existing password login until enrolled. Readable passwords are not retained in browser storage.
While Active
The active data key is used in browser memory. Browsers retain wrapped keys and non-extractable device keys, and iOS can retain keys in Keychain.
After Session Lock
After an inactivity lock, you may need to sign in and unlock encrypted fields again. Stored credentials and native Keychain behaviour vary by flow.
The Best Part: No Extra Steps
Unlock requirements depend on how your account was created: login password, separate OAuth vault password or native Keychain.
Security Best Practices
Use a Strong Password
Since your account password unlocks both your account and your encryption keys, choose a strong, unique password. Use a password manager if possible.
Save Your Recovery Key
Store your recovery key in a secure location (password manager, encrypted file, safe). You'll need it if you ever lose access to your account.
Sign Out on Shared Devices
On shared or public computers, always fully sign out when you're done. This is more secure than relying on the timeout.
Trust the Timeout
Timeouts reduce exposure but do not replace signing out or securing your device.
Troubleshooting
My session locks too frequently
The 15-minute timeout is a security feature and cannot be extended. However, any activity (clicking, typing, page navigation) resets the countdown.
Tip: Keep the tab active while working to avoid locks. If your session does lock, simply refresh the page and log in again - unlock is automatic.
I didn't receive a warning before lock
The warning appears at 13 minutes. If you have ad blockers or script blockers enabled, they may interfere with the warning banner.
Solution: Whitelist PopaDex in your browser extensions.
I can't access my data after the timeout
Sign in or unlock again when prompted. If decryption fails, retain existing browser storage and ask support for help.
Sign in again when prompted. Password accounts may unlock using the original password; OAuth vault and native Keychain flows have separate unlock requirements.
Session locks even when I'm active
This could indicate a browser or network issue preventing activity tracking from working properly.
Try: Refresh the page, clear your browser cache, or try a different browser. If the problem persists, contact support.
Related Help Articles
Still need help?
Contact Support