Personal keys and unlock
MailGen can protect mail with a personal RSA key pair created in the browser. It stores the public key durably. The KeyStore process holds the private key only in memory during an active lease. Start with encryption settings.
Back up and unlock
Download the private-key backup during setup. Keep it separately in a secure location. To read existing encrypted content, import the correct original owner's key. A new key does not decrypt old content.
The default unlock lasts 3600 seconds. The decrypted cache defaults to 300 seconds and cannot outlive the unlock. Lock, logout, expiry, or a KeyStore restart prevents cache access to locked content. New incoming content can still use the public key for encryption while locked.
If the only private-key backup is lost, encrypted content cannot be recovered. The server and administrator hold no recovery private key.
Operations and failures
KeyStore, the short-lived Dragonfly cache, and the read-only diagnostic viewer belong to the deployment instance. The cache is not a durable backup. An administrator's viewer access does not replace the owner's unlock.
For a key error, check the owner, backup, and unlock state in the application. Do not generate a replacement key for old ciphertext. Do not delete storage volumes to repair a key error. Operators manage runtime settings through central configuration.