Secret storage

The passwords, tokens and key passphrases you give a connection are its secrets. DataKlin never writes them into its connection settings. You choose, for each secret, how long DataKlin keeps it.

Jump to your system: macOS, Windows or Linux.

How DataKlin protects saved secrets

• Encrypted by your operating system. DataKlin encrypts a saved secret with Electron’s safeStorage, using a key your operating system holds: the Keychain on macOS, DPAPI on Windows, and a keyring through libsecret or KWallet on Linux.
• Stored as ciphertext. The encrypted secret is kept in DataKlin’s local app database on your computer. Nothing is sent anywhere else.
• Decrypted only when connecting. DataKlin decrypts a secret only to open a connection, and the window you work in never receives it.
• Never copied. Duplicating a connection doesn’t copy its secrets: the copy asks for them the first time it connects.
• Tied to this computer and account. Saved secrets can’t be decrypted elsewhere. If you copy DataKlin’s data to another computer, it asks for those secrets again.

Retention options

Next to each secret field, the connection dialog lets you choose how long DataKlin keeps that secret.

Option	What DataKlin does
Save	Encrypts the secret and keeps it, so it’s there after DataKlin restarts.
Until DataKlin quits	Keeps the secret in memory only. After a restart, DataKlin asks for it again when you connect.
Ask every time	Never keeps the secret. DataKlin asks for it each time you connect.

When DataKlin asks for a secret as you connect, you can choose the option again for what you type.

macOS

DataKlin’s encryption key is kept in your login keychain. Other users of the Mac, and other apps you run, can’t read it without your permission.

• The first time DataKlin saves or reads a secret, macOS may ask whether DataKlin can use its key in your keychain. Allow it, so DataKlin can read your saved secrets.
• DataKlin 0.2.0 and earlier weren’t signed (see Opening an unsigned build), so macOS may ask again after each update between them, because it can’t tell that the new version is the same app.
• When you first start a signed build after DataKlin 0.2.0 or earlier, macOS asks once whether DataKlin may use “DataKlin Safe Storage” in your keychain. Choose Always Allow so your saved secrets keep working.

Windows

DataKlin’s encryption key is protected with DPAPI, the Windows data protection API, under your Windows account. Other users of the computer can’t decrypt your saved secrets. Apps running under your own account aren’t kept out, so keep the account itself secure.

There is nothing to set up.

Linux

On Linux, DataKlin needs a keyring to encrypt the secrets you save: GNOME Keyring (through libsecret) or KWallet. If DataKlin finds none, it can’t encrypt them, and it tells you so the first time you open a connection’s secret fields:

Saved secrets can’t be encrypted on this system

DataKlin found no keyring here (such as GNOME Keyring or KWallet), so it can’t encrypt the passwords and keys you save.

What basic_text means

DataKlin asks Electron which secret store it can use. Electron chooses one from your desktop environment. When it finds no keyring, it reports basic_text: secrets would then be “encrypted” with a password built into Electron itself, which is effectively plaintext. DataKlin doesn’t count that as encryption.

What DataKlin does without a keyring

• By default, secrets are kept only until DataKlin quits. Choosing Save keeps a secret only Until DataKlin quits, and DataKlin asks for it again after a restart. Under each secret field, the dialog reminds you: “This system has no keyring, so DataKlin can’t encrypt saved secrets. Unless you opt in, they are kept only until DataKlin quits.”
• You can opt in, per connection. Tick Save secrets for this connection without encryption to save that connection’s secrets anyway. They’re then stored without real encryption: anyone who can read your files can read those secrets, including other programs you run and anyone with a copy of your home folder or its backups. Opt in only for secrets you can afford to expose.

Setting up a keyring is the better fix.

Set up a keyring

1. Install a keyring. Use the one that belongs to your desktop:

   • GNOME Keyring (GNOME and most other desktops): install gnome-keyring and libsecret. For example:

     # Debian, Ubuntu
     sudo apt install gnome-keyring libsecret-1-0
     # Fedora
     sudo dnf install gnome-keyring libsecret
     # Arch Linux
     sudo pacman -S gnome-keyring libsecret

   • KWallet (KDE Plasma): KWallet usually comes with Plasma. Make sure it is enabled in System Settings.

2. Make sure it unlocks when you log in. DataKlin can’t use a locked keyring. GNOME Keyring unlocks its default keyring at login when that keyring’s password matches your account password. KWallet unlocks at login with the kwallet-pam module. If you log in automatically, the keyring may stay locked until something asks for it.

3. Restart DataKlin. On desktops Electron recognises, that’s all: GNOME, Cinnamon, Deepin, Pantheon, Xfce, UKUI and Unity use GNOME Keyring, and KDE uses KWallet.

Tell DataKlin which keyring to use

On desktops Electron doesn’t recognise, such as tiling window managers (i3, Sway, Hyprland and others), DataKlin finds no keyring even when one is running. Start DataKlin with the --password-store flag to name it:

Keyring	Flag
GNOME Keyring (libsecret)	--password-store=gnome-libsecret
KWallet 6 (Plasma 6)	--password-store=kwallet6
KWallet 5 (Plasma 5)	--password-store=kwallet5

For example:

dataklin --password-store=gnome-libsecret
# or, for the AppImage
./DataKlin-*.AppImage --password-store=gnome-libsecret

The keyring must be installed, running and unlocked: if it isn’t available, DataKlin still finds no keyring.

To use the flag every time, add it to DataKlin’s launcher. Copy the .desktop file that the deb installed in /usr/share/applications/ to ~/.local/share/applications/, which takes precedence, and add the flag to its Exec line. For the AppImage, create the file there yourself. For example:

[Desktop Entry]
Type=Application
Name=DataKlin
Exec=dataklin --password-store=gnome-libsecret %U
Categories=Development;

For the AppImage, put the AppImage’s full path in Exec, for example Exec=/home/you/Applications/DataKlin.AppImage --password-store=gnome-libsecret %U.

After you fix it

• The notice and the reminder under secret fields no longer appear.
• Secrets that DataKlin kept Until DataKlin quits aren’t saved anywhere, so it asks for them once more. Enter each one again with Save, and from then on it’s encrypted by your keyring.
• If you opted in with Save secrets for this connection without encryption, replace those secrets: untick the option, then enter each secret again with Save, so it’s encrypted by your keyring.