Troubleshooting

Troubleshooting

English · Русский

Connections

Message	What it means
Host key changed. Resolve it in Known hosts.	the host presented a different key than the one you trusted. Either the server was rebuilt, or the connection is being intercepted. Check with whoever runs the host, then remove the old entry in Vault → Known hosts.
Host key not trusted yet.	the probe path found no trusted key. Connect once from a terminal so the key can be vouched for, or add its CA in Known hosts.
Host key not accepted.	you refused the key. Connect again to see it.
Vault locked: host key trust can't be read.	trust lives in the vault — unlock it and retry.
This host must present a certificate from a trusted CA…	the host is covered by a @cert-authority entry and offered something else.
Jump host — …	the failure happened on a hop, not on the destination. The chain fails rather than silently going direct when a jump is dangling, non-SSH, secretless or cyclic.

Auto-reconnect applies to SSH and container sessions. Mosh sessions are never reconnected by the client — the protocol rides out the outage itself.

Sync

Message	What it means
Wrong password or account. For a new account, use this vault's password.	the SRP exchange failed. The account password is the vault master password.
Can't reach the server	network or URL. Check that the WebSocket path is proxied too — a proxy without Upgrade/Connection headers breaks live push while everything else works.
Pairing code expired / not valid	the one-shot code has a short TTL (5 minutes by default); produce a new one.
This device must rebuild its data from the server — reconnect to sync	the device's cursor is unusable and a full pull is needed.
The server refused this request — ask its administrator	registration may be closed, or admin policy rejected it.
Local vault is corrupted	the vault file failed to decrypt or parse. Restore the file from a backup; there is no other recovery.

Vault

• Forgotten master password — unrecoverable, by design. Argon2id slows brute force but there is no reset and no escrow.
• Biometric unlock turned itself off — connecting to a sync account changes the vault key. Enroll again from Settings → Security.
• Trash is empty but you expect items — the trash window is 30 days, and it is inside the vault: unlock first.

Remote desktops

• The keyboard seems stuck in the session — every key goes to the guest by design; press Ctrl+Alt+Shift+K (⌃⌥⇧K) to hand it back.
• No H.264 — desktop needs ffmpeg on PATH; without it the session falls back to the other codecs.
• Audio stops — The audio device stopped taking sound: pick another output in the profile and reconnect.
• Scrolling behaves oddly — a known open issue (#265).

Clipboard

• Wayland — copying goes through wl-clipboard; without those binaries the terminal copy path reports a refusal rather than silently writing where nothing can paste from.
• tmux/vim cannot set the clipboard — server clipboard writes (OSC 52) are off by default; turn them on in Settings → Terminal.

Desktop packaging

• macOS refuses to open the app — builds are unsigned: right-click → Open, or allow it in System Settings → Privacy & Security.
• macOS shows version 1.x.y — packaging requires a major version ≥ 1; the real version is on the About screen.
• Windows SmartScreen warning — the .msi is unsigned.

Reporting a problem

Bugs and feature requests: issues. Security problems go through private reporting instead — SECURITY.md.