> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.walletchan.com/api/mcp` to find what you need.

# Passwords and unlock

The master password decrypts WalletChan's protected local records and
authorizes master-only changes. It is not an Ethereum private key and does not
exist onchain.

## Password policy

New master and agent passwords must be 8–256 characters and pass a
common-password denylist. Use a unique password stored in a trusted password
manager.

## Unlock

The unlock screen accepts the master password, a configured agent password, or
a supported biometric/passkey assertion. It can show the count and type of
pending requests waiting for your decision.

Unlocking is not signing. Each transaction/signature still gets a review.

## Auto-lock

Choose **1, 5, 15, or 30 minutes; 1 or 4 hours; or Never**. The default is 15
minutes. For finite timeouts, WalletChan pauses the close-based timer while a
trusted wallet surface remains open and starts it when the last surface closes.

Never keeps a restorable session and has a stronger warning. Use manual Lock
and close the browser on shared devices.

## Manual lock

Select Lock from Home. WalletChan revokes the active secret capabilities across
surfaces. If secure lock cannot be confirmed, the fail-closed screen tells you
to retry or close the browser.

## Change master password

**Settings → Security → Change Password** verifies the current master
password, rotates encrypted wrappers atomically, clears agent/passkey factors,
and locks the wallet. Agent sessions cannot change it.

## Forgot password or reset

WalletChan cannot send a reset email. A full reset deletes local accounts,
credentials, encrypted keys/phrases, history, sessions, pending requests, and
WalletConnect state. Shield data adds an explicit loss warning, and unresolved
irreversible effects can block reset.

Resetting does not delete onchain funds, but without the backed-up key, seed
phrase, Ledger recovery, Safe owners, or Bankr account access you may no longer
control them.

## Related guides

* [Back up keys, phrases, and account access](/security/backups)
* [Set up passkey-backed biometric unlock](/security/biometric-unlock)
* [Use a constrained agent password](/security/agent-password)
* [Manage local data and history](/settings/data-and-history)