Encrypt your data file and lock the app

Out of the box your data file is plain JSON, readable by anyone who can open the file. If it holds client networks you’d rather not leave lying on a share or a laptop, encrypt it. Encryption is optional and free for everyone. Once the file is encrypted you can also lock ArkhiNet when you step away.

How the encryption works

• Your inventory is encrypted with a random 256-bit data key using AES-256-GCM.
• The data key is never stored as is. The file carries copies of it wrapped (encrypted) under keys derived with scrypt from your passphrase and from a one-time recovery code.
• Changing your passphrase only re-wraps the data key, so it’s quick and your recovery code keeps working.
• An encrypted file uses the .arkhinet extension instead of .json. ArkhiNet renames the file when you turn encryption on, and back to .json when you turn it off.

The scripts file next to your data file is encrypted with the same key (it becomes <name>.scripts.arkhinet). Your RECENT list and Find history for an encrypted file are sealed with that key too, instead of being kept in plain text on this computer.

Turn on encryption

1. Open Settings (⚙ or Ctrl+,) and click Security.
2. Next to Encrypt the data file, click Encrypt….
3. Type a passphrase of at least 8 characters, then type it again under Confirm passphrase.
4. Read the warning, then tick the I understand checkbox below it.
5. Click Encrypt.
6. ArkhiNet shows Save your recovery code now with a code in the form XXXXX-XXXXX-XXXXX-XXXXX-XXXXX. Click ⧉ Copy or write it down, store it somewhere safe and away from the data file, then click I’ve saved it to finish.

Caution

The recovery code is shown exactly once. If you lose both the passphrase and the recovery code, your data is gone for good. There’s no reset, and no one, including ArkhiNet, can recover it.

Open an encrypted file

When ArkhiNet starts with an encrypted file, it shows a lock screen.

1. Type your passphrase and click Unlock (or press Enter).
2. Lost the passphrase? Type the recovery code in the same box instead. It forgives lowercase letters, missing dashes, and mixing up 0/O or 1/I/L. Then set a new passphrase in Settings.

Change the passphrase or remove encryption

In Settings, Security:

• Change Passphrase… asks for the current passphrase and the new one twice. Your recovery code stays valid.
• Remove Encryption… asks for the passphrase, then writes the data back to disk as readable JSON.

Backups are copies of the file as it was, so each one needs the passphrase that was active when it was made. The recovery code opens all of them, because the data key never changes.

Lock ArkhiNet

The lock is available only while the data file is encrypted. Locking clears the key from memory and discards the open inventory, and you need the passphrase (or recovery code) to get back in.

• Lock now: click the 🔒 button at the right end of the tab strip, next to the window’s minimize button.
• Lock when idle: under Settings, Security, Lock, set Auto-lock when idle to a number of minutes and click Save. The default is 15 minutes, and 0 turns idle locking off.

ArkhiNet won’t lock while you have unsaved edits or a save conflict waiting for your answer. The idle lock simply tries again a little later.

Open terminal sessions keep running while the app is locked, but they’re hidden and take no input until you unlock. A session that’s being logged keeps logging.

Remember the passphrase on this computer

If you’d rather not type the passphrase at every launch, ArkhiNet can store it encrypted under your Windows account using Windows DPAPI.

• Tick Remember on this computer on the lock screen when you unlock, or
• In Settings, Security, click Remember… next to Remember on this computer, type the passphrase and click Save.

This only covers unlocking at launch. After a manual or idle lock, the passphrase is always required. Click Forget to remove it. ArkhiNet also forgets it when you change the passphrase, remove encryption or switch to another data file.

Caution

Anyone who can sign in to your Windows account can open your data once the passphrase is remembered.

What encryption doesn’t cover

These stay as plain files, even when your data file is encrypted:

• Exports: PDF inventory reports and topology PNG or PDF files.
• Files you open or save in Notepad.
• Session logs. Device output can include sensitive details such as config dumps.
• Files you download with File Transfer.
• config.json, ArkhiNet’s per-computer settings file. See Where your data lives.