How do I encrypt my history on this computer?

Open Settings → Privacy. In the Encryption card, press Turn on next to Encrypt my history, type your backup passphrase, and press Encrypt my history. It is off until you do this.

Your history stays on your computer either way. Encryption changes how it is stored there: once it is on, someone who copies the files, or takes the disk out, sees only scrambled data.

#Before you start

Encryption needs backups locked with a passphrase, and a backup made in the last day. Until you have both, the card shows what is missing in place of the Turn on button:

• Set up backups: there are no locked backups yet. The card explains why they come first: “that passphrase is what unlocks your history if this Mac ever loses its key.” See how to set up backups.
• Back up first: your last backup is more than a day old. Converting rewrites every file of your history, so the app asks for a backup from the last day first.
• Open Backup: your backup folder could not be found. If it is on a drive, connect it.

It cannot start during a dictation, or while a backup or an import is running.

#Turn it on

1. Open Settings → Privacy. In the Encryption card, press Turn on.
2. Under Backup passphrase, type the passphrase your backups are locked with. It has to open your last backup.
3. Press Encrypt my history. Each file is converted into a copy, the copy is checked against the original, and only then does it replace it. Dictation waits until this is done, usually a minute or two.

That is not the passphrase of your last backup. It is the one your backups are locked with.

#What is encrypted

Your history with its recordings, your notes, the history you imported from other apps, your prompts, your snippets and your vocabulary. Prompt pictures and your settings are not encrypted.

Your backups were already locked with your passphrase. While your history is encrypted they always are: None cannot be chosen.

#Where the key is kept

One random key locks the files. It is kept in the macOS Keychain on a Mac, or the Windows Credential Manager on a PC, as an item named history-key under com.vibhaga.dictatesafe. Do not delete it. A spare copy of the key, locked with your backup passphrase, sits beside your data, so if the computer ever loses the key, your backup passphrase puts it back.

If you later make a backup with a new passphrase, the spare copy is locked with the new one, so the passphrase of your latest backup is the one that unlocks it.

#What it protects, and what it does not

It protects the files. Someone who copies them, or takes the disk out, sees only scrambled data. It does not protect against:

• Someone who can sign in to your computer account. For them Dictate Safe opens normally and shows your history.
• Malware, or any software running as you. On Windows, other programs running as you can read the key from Credential Manager. On a Mac, the Keychain asks before any other app may read it.
• Copies made before you turned it on, such as Time Machine or File History backups. They stay as they were.

Without FileVault on a Mac, or BitLocker on Windows, the old unencrypted files can also linger in the disk’s free space until they are overwritten. Keeping disk encryption on as well covers that.

#Turn it off

In the Encryption card, press Turn off, then Turn it off. It converts everything back to how it was stored before, the same careful way, and removes the key.

If you press Stop while it is converting, files already converted stay converted and checked, and the rest are as they were. The card then offers Finish, or turning it off to put everything back as it was.