Desktop app
Keychain
Where the desktop app keeps your sign-in, and how to fix "Tyto can't reach your system keychain".
The desktop app keeps you signed in by saving your password and session for each server. It encrypts them with a key that your operating system holds, so the files on disk are useless without your login to the computer.
| System | Key is kept by |
|---|---|
| macOS | Keychain |
| Windows | Windows data protection, tied to your user account |
| Linux | A secret service — GNOME Keyring, KWallet or compatible |
If no such service is available the app refuses to start. It never falls back to storing your sign-in unprotected.
“Tyto can’t reach your system keychain”
This appears on Linux when no secret service is running or it’s locked.
- Install a secret service
GNOME Keyring works on any desktop, including window managers such as Hyprland, Sway and i3. Debian and Ubuntu:
sudo apt install gnome-keyring libsecret-1-0. Fedora:sudo dnf install gnome-keyring libsecret. Arch:sudo pacman -S gnome-keyring libsecret. - Make sure it starts with your session
Full desktops such as GNOME and KDE Plasma do this for you. On a bare window manager, start the keyring from your session startup and unlock it at login — your distribution’s documentation for GNOME Keyring covers the PAM setup.
- Start Tyto again
Log out and back in first, so the keyring is running and unlocked.
On a desktop the app doesn’t recognise, it asks for the secret service by
itself. To choose a different store, start the app with
--password-store=kwallet6 (or kwallet5, gnome-libsecret).
What is stored, and where
Per server: your password and the current session token, both encrypted. Alongside them, unencrypted: the list of servers, your email and display name on each, and the app’s own settings.
| System | Folder |
|---|---|
| macOS | ~/Library/Application Support/tyto |
| Windows | %APPDATA%\tyto |
| Linux | ~/.config/tyto |
Sign out deletes the saved password and session for that server. Remove deletes them together with the server entry.
What the keychain doesn’t protect against
The keychain ties your sign-in to your account on the computer. Anyone who can use that account can open the app as you. Two people sharing one computer need two accounts on it.
Signed out after an update or reinstall?
The encryption key belongs to the app, so reinstalling the same app keeps you signed in. If the app ever opens on Welcome back instead, the saved sign-in could not be decrypted — sign in once and it’s saved again.