Why Your Vault Locks Itself (and How Unlocking Works)

Come back to a LifetimeCloud tab after a while away and you won't just see your files — you'll see a lock screen asking for your password again, even though you never explicitly logged out. That's not a bug or a session timeout being stingy. It's the encryption key being deliberately dropped from memory.

Login and unlock are two different things

On a normal cloud service, "logged in" is the only state that matters — once authenticated, the server can show you your files indefinitely because it holds the data in plaintext anyway. On LifetimeCloud, your session token proves who you are, but it says nothing about whether your browser currently holds the encryption key needed to actually decrypt anything. That key only exists in memory after you've entered your password and it's been derived locally.

The lock screen appears when your session is valid but the in-memory key has been cleared — you're still "you," you just need to prove you have the password again before the browser will reconstruct the key.

Why the key gets dropped instead of staying cached

Keeping a decryption key sitting in browser memory indefinitely is a liability — a shared computer, an unlocked phone handed to someone else, or a browser extension with broad permissions all become bigger risks the longer that key persists. Clearing it and requiring the password again:

• Limits the window in which the key is usable if a device is left unattended.
• Means closing and reopening the tab after a while genuinely re-establishes that it's still you typing, not just a token replaying itself.
• Costs you one password entry in exchange for a real reduction in what a stolen or borrowed session can do.

What unlocking looks like

The unlock screen asks for your password — nothing else, unless you have two-factor authentication enabled, in which case you'll also enter your 6-digit code from your authenticator app before the vault reopens. Enter it wrong, and you'll see a clear error rather than a silent failure. There's also a direct "Not you? Log out" option, useful on a shared or borrowed device where re-locking immediately is the safer move.

What this means day to day

You'll see the lock screen after closing and reopening the app, after your browser or device restarts, or after enough idle time — it's a small habit to adjust to if you're coming from a cloud provider that never asks twice. In exchange, the actual decryption key spends less time sitting around unused in memory than it would on a system that treats "logged in" as good enough forever.