Protect stored credentials

Local protection applies to Secret Access Key and Session Token values entered through Stored credentials. It covers every account in this installation, using one master password. It does not encrypt other account settings or Access Key ID.

AWS profile and AWS default credential chain do not copy their secrets into S3Client. They remain usable while stored secrets are locked. Protection of their files and caches is managed outside S3Client, in your AWS environment.

The master password does not change keys or permissions on the S3 service. It cannot be recovered. Keep it safe before enabling protection: losing it prevents recovery of the protected secrets.

By default, S3Client encrypts secrets with its built-in key. A successful protection change is saved immediately; closing Credential protection or Accounts does not discard it. Unlocking lasts for the session and does not remove the master password.

Enable the master password#

1. In the main window, choose File > Accounts….
2. In Accounts, choose Manage accounts > Credential protection….
3. In Credential protection, click Enable master password….
4. Enter New master password and repeat it in Confirm master password. The password must not be empty.
5. Click OK.
6. Check that the status says secrets are protected and unlocked for this session, then click Close.

Passwords do not match means the two entries differ. No secrets have changed; correct the fields. Cancel abandons activation; secrets remain encrypted with the built-in key.

Master password required means the new password is empty. Password fields mask your input and preserve spaces: spaces are part of the password and must be entered again when unlocking.

An export containing secrets requires this mode. Importing a file containing secrets can also enable it with the password used for the export.

Unlock for the session#

When you start a new S3Client session, secrets protected by a password are locked. S3Client requests unlocking when an action needs them, including opening the editor for an account that uses stored secrets.

If at least one enabled account uses Stored credentials, S3Client also prompts at startup so it can load that account’s buckets. Cancel leaves the secrets locked; you can unlock them later through Credential protection. Accounts using AWS sources remain available.

1. In Unlock stored credentials, read which action needs the secrets.
2. Enter Current master password.
3. Click OK.

You can also open File > Accounts… > Manage accounts > Credential protection… and click Unlock stored credentials…. Unlocking covers all stored secrets for the session, not just the selected account. The button changes to Change master password… once the vault is unlocked. Close S3Client to end the session.

The dialog has no button for locking the vault again during a session. Closing Credential protection keeps it unlocked; after closing and restarting S3Client, you will need the password again.

The master password is incorrect. leaves secrets locked and data unchanged. Click Retry to try again, or Cancel to abandon the action requiring secrets. Accounts using AWS sources remain available.

Change or disable the password#

To change the password:

1. Open File > Accounts… > Manage accounts > Credential protection….
2. If necessary, click Unlock stored credentials… and unlock the vault.
3. Click Change master password….
4. Enter Current master password, then New master password and Confirm master password.
5. Click OK, check that you have returned to Credential protection, then close it.

This re-encrypts every stored secret key and session token. Account settings and AWS sources are preserved. Existing exports remain encrypted with the password used when they were created.

Disabling the master password protects secrets with S3Client’s built-in key again. Someone with access to the application and its data can then recover them.

1. In Credential protection, click Disable master password….
2. Enter Current master password.
3. Click OK.
4. Check that the dialog describes the built-in key and shows Enable master password….

Failures appear under Credential protection error, with technical details. The message states that no account data was changed.

Lost password: remove stored secrets#

Reset stored credentials… permanently removes all credentials stored by S3Client: Access Key ID, Secret Access Key, and Session Token. It does not recover secrets and does not require the lost password. Affected accounts are disabled. Their other settings are retained; accounts using AWS sources are preserved.

The master password is disabled. Future secrets will be encrypted with S3Client’s built-in key. Keys are not revoked on the service, buckets and objects are not deleted, and AWS files are unchanged. If you still have access to the secrets, export them before proceeding.

Resetting does not cancel an S3 request that has already been sent, and an operation that has already loaded the keys may continue to use them. If you also want to stop transfers, cancel the affected operations before resetting credentials.

1. Open File > Accounts… > Manage accounts > Credential protection….
2. Click Reset stored credentials….
3. In Reset stored credentials, read the consequences and click Reset. Cancel keeps the data.
4. Check that Enable master password… is available, then close the dialog.
5. In Accounts, check that affected accounts are disabled. For each one, select its row, click Edit…, and open Credentials.
6. Enter valid credentials or choose an AWS source, save with OK, then choose More > Enable.
7. Enable the master password again if you want password protection.

This differs from Manage accounts > Reset accounts…, which deletes every account and its settings. See Add and manage accounts.

Unreadable storage#

Stored credentials unavailable means storage is damaged, incomplete, or uses an unsupported format. Read the details before resetting: unreadable data may not be recoverable. An unsupported format requires an S3Client version that can read it. AWS sources do not require unlocking stored secrets, provided the account data itself remains readable.