App lock
App lock is an optional credential gate that runs before any chat data loads, with opt-in triggers that re-engage it mid-session. Configure it in Settings → Security.
PIN, password, or both
Click Set up app lock and pick a Lock method:
- PIN - 4, 6 or 8 digits. Quick to type on a numeric pad.
- Password - at least 8 characters.
- PIN + password - both required. The PIN is asked first because it is faster to type.
You type each new credential twice, then click Enable lock. An optional Hint of up to 120 characters can be stored alongside, so you have something to read after a failed unlock. The hint is plaintext on purpose - if it were encrypted with the password, you would need the password to see the hint, which defeats the point. Don’t put the secret itself in it.
Once a lock is on, the Security tab shows what is required at launch, with Change and Remove app lock buttons. Both ask for your current credentials first (see below). When you change the lock, the hint field starts with your current hint, so it is kept unless you edit it.
How credentials are stored
Loach never writes the PIN or password to disk in plaintext, and never stores them in the SQLite database. The lock blob - Argon2id hashes with a random salt, plus your hint - lives in the OS credential manager. On Windows that is Credential Manager; on Linux it is the Secret Service via your desktop’s keyring; on macOS it is the Keychain. Credentials are checked in the app’s backend, and the hashes never reach the interface.
Next to the database, Loach also keeps app_lock.json, a marker with no secrets in it: whether a lock is set, its method, the PIN length and whether there is a hint. Launch reads that marker, so the lock screen comes up at once, without reading the credential store and without a keychain prompt in front of it. The store is read when you unlock, and if that read fails or is refused, Loach stays locked.
The lock controls who can use Loach on this machine. It does not encrypt your chats: the database in the app-data folder stays readable to anything running as your user account. Launch only asks the credential store whether a lock is set when the marker file is missing. If that check fails, Loach starts unlocked rather than locking you out of your own data; if it is still unanswered after 5 seconds, Loach opens, and puts the lock screen up as soon as the answer finds a lock.
The lock screen
On launch, the Loach is locked screen fills the window, and your chats aren’t loaded until you authenticate. The title bar’s window controls keep working, but search, the sidebar toggle and the Private Chat button are hidden. When both a PIN and a password are required, the PIN field comes first and focus jumps to the password once the PIN is complete. A wrong attempt clears the PIN field but keeps the password field, so you can fix a typo without retyping everything. If you set a hint, Show hint reveals it.
Rate limiting
After 5 consecutive wrong attempts, every credential check is refused for a cool-off window that starts at 30 seconds and doubles with each further failure (60 s, 2 min, …), capped at 2 hours. The lock screen shows Too many failed attempts. Try again in N seconds. The counter is shared, so wrong credentials in a re-authentication prompt (see below) count too. It resets on a successful check and when the lock is set up or removed. The count and any cool-off are saved next to the database (app_lock_attempts.json), so restarting Loach doesn’t reset them.
Auto-lock
On its own the lock only gates launch: clear the lock screen once and you stay unlocked until you quit. That covers a stolen laptop but not the more common risk - walking away from an unlocked machine. Two opt-in triggers close that gap, both in the Auto-lock card that appears in Settings → Security once a lock is configured:
- Lock after inactivity - Off (the default), or 1, 5, 15 or 30 minutes with no typing, clicking, scrolling, touch or mouse movement over Loach (typing or clicking inside an HTML preview counts too). A reply already streaming keeps running behind the lock screen. The deadline is re-checked periodically rather than driven by one long timer, so a machine that sleeps through the interval is locked the moment it wakes; the trade-off is that the lock can land up to 15 seconds late.
- Lock when minimized - off by default. Locks as soon as the window is minimized or otherwise hidden. It is keyed on visibility, not focus, so a native save or open dialog (export, import, attaching a file) does not lock you out mid-task.
Ctrl + Shift + L (⌘ + Shift + L on macOS) locks immediately from anywhere in the app - Private Chat included - whether or not either trigger is on. So does the /lock command. On macOS, closing the window hides Loach rather than quitting it, and with a lock set that always locks it too.
Locking mid-session puts the lock screen back, and a reply that is streaming keeps going. It also:
- Ends a Private Chat - an open Private Chat is closed and wiped, as if you had closed it yourself.
- Closes confirmations - an open confirmation or prompt is dismissed as cancelled, and no new one opens while Loach is locked.
- Clears toasts - toasts on screen, Undo buttons included, are dropped, and none show until you unlock.
Unlocking takes you back where you were: the open chat and its unsent draft are still there, and nothing from startup runs again.
Re-authentication for destructive actions
Even after you unlock the app, changing or removing the lock and the destructive Data management actions (Import data, Remove my data and Factory reset) ask for your current credentials again. They are checked in the backend before anything happens, so a compromised interface cannot silently disable the gate or trigger a wipe. Factory reset also removes the lock itself.
Loach has no “forgot your PIN” flow, and the in-app Factory reset asks for your credentials too. If you lose them, the way back in is deleting the lock’s entry from your OS credential manager by hand - see I forgot my PIN or password. Make sure your hint is enough.