Last updated: September 14, 2026tiCrypt 2.17.9

Private Keys

Your private key is what decrypts your data. It lives in a key file on your machine, named your-user-name(mm-dd-yy).key, and the Connect Application loads it at login rather than storing it on any server.

You can hold more than one key in the Connect Application at once. This is normal if you work across several deployments, or hold both a user account and an escrow account. Each key is listed separately on the login page with its own color and icon.

warning

If you lose both your password and your key file, your data cannot be recovered unless your deployment has key escrow configured. Keep backups of the key file in more than one secure location, and never share it with anyone, including administrators.

Load Your Private Key

1. Open the Connect Application.
2. Select your deployment card.
3. Click the Load Key button in the center.
4. Find and select your private key file your-user-name(mm-dd-yy).key.
5. Click Open.

Add Additional Private Keys

1. Open the Connect Application.
2. Select your deployment card.
3. Click the Add key button in the center right.
4. Find and select the additional private key file user-name(mm-dd-yy).key.
5. Click Open.

Switch Between Private Keys

1. Open the Connect Application.
2. Select your deployment card.
3. Click the Dropdown button next to the user name and icon in the center.
4. Select a different user name from the list.
5. Enter the corresponding private key password.
6. Click the Login button.

Download a Private Key

1. Open the Connect Application.
2. Select your deployment card.
3. Click the Download button in the center right.
4. Select a folder to save the private key file user-name(mm-dd-yy).key.
5. Click Save.

Delete a Private Key

1. Open the Connect Application.
2. Select your deployment card.
3. Click the Delete button in the center right.

caution

This removes the key from the Connect Application on this machine. It does not delete your account, and it does not delete any backup copies of the key file you saved elsewhere. If this was your only copy, you have lost access to your data.

Key Icons

tiCrypt assigns each key a color and icon automatically. They cannot be changed. They exist so you can tell keys apart on the login page when you hold several.

How Escrow Protects Your Key

Every user has a private key and a public key. The public key can be shared freely. The private key must never be shared with anyone, including administrators.

Key escrow does not take your key away or break it into pieces. Your key file stays with you. Escrow adds a recoverable backup, so losing your key file is not permanent.

When your account is escrowed, your private key is encrypted with a separate Recovery Key, and only that encrypted copy goes to the server. What gets split is the Recovery Key, not your private key. It is divided into one key part per escrow group, and the Recovery Key itself is discarded immediately after use. Nobody holds it, including tiCrypt. It exists only long enough to encrypt your key, and comes back only by combining every group's key part.

Recovery therefore needs one member from each escrow group. Because the groups are independent, no individual and no single group can reconstruct your key alone. A deployment needs a minimum of three escrow groups.

note

Every member of an escrow group holds that same group's key part. A group can take part in recovery as long as any one of its members is available, so recovery does not depend on one particular person.

Get a New Key After Losing Your Password

See Change Password, which covers both changing a password you know and recovering from one you have lost.