[aakashns]

On a Mac with Touch ID, writui can now unlock with your fingerprint.

What changed

• "Create your vault" has a "[ ] Unlock with Touch ID" box under the password boxes, on Macs that can use it. Click it or press Ctrl+T to tick it.
• Settings has a "Touch ID" switch, also shown only on Macs that can use it. Once Touch ID is on, writui asks for your fingerprint as soon as it starts.
• After locking (Ctrl+O), press Enter, or click the Touch ID button next to Unlock.
• The password always works too. Cancel the fingerprint prompt, or just type it. Over SSH, writui never asks for a fingerprint (the prompt would appear on a screen nobody is looking at).
• Where Touch ID is available but off, the unlock screen's Overview has one more line pointing to Settings.
• Unlocking with Touch ID is instant, because the slow password check is skipped.

How it works (and why not the keychain)

Storing the password in the keychain behind Touch ID needs the app to be signed with an Apple developer identity, and writui's releases aren't. A plain keychain entry would also make macOS ask for your Mac password after every writui upgrade. So writui uses the Mac's Secure Enclave (the chip behind Touch ID) instead:

• Turning it on creates a key inside the Secure Enclave and uses it to lock away your vault's key. The result goes in ~/.config/writui/touch-id/, one file per vault. The file is useless on any other computer, and even on this Mac it only opens after a fingerprint. The Secure Enclave enforces that, not writui.
• Upgrades don't affect it: I tested that a different build can use the key.
• Adding a new fingerprint to the Mac deliberately stops it working, so someone who knows your Mac password can't add their own finger to get in. writui says Touch ID didn't work, and your next password unlock sets it up again on its own.
• Nothing changes inside the vault: no migration, and your password and writing are untouched. Turning Touch ID off deletes that one file.

The details are in docs/DECISIONS.md.

Try it

gh pr checkout 30 && cargo run

(Debug builds use .dev-data/, password writui-dev.)

1. Unlock with the password, press s, go down to Touch ID, press Enter: it reads "on".
2. Press Ctrl+O to lock, then Enter: the fingerprint prompt appears. Touch the sensor and you're back on Settings.
3. Lock again, press Enter, and this time click Cancel on the prompt. You should get "Touch ID cancelled." (Confirmed by the creator.)
4. Quit and run cargo run again: it asks for the fingerprint straight away.
5. To see the checkbox: cargo run -- --db /tmp/w/writui.db, then click "[ ] Unlock with Touch ID" (or press Ctrl+T) before creating the vault.

Your real vault only gets Touch ID once this is released and you turn it on in Settings there.

Screenshots

Creating a vault, with the Touch ID box ticked:

Locked, with Touch ID on:

The Settings switch:

On a Mac where it's off, the Overview points to it:

The landing page's privacy point now mentions it:

Version bumped to 0.18.0.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: In progress 🔵 View logs ↗		4c08510	2026-10-17T12:36:25.409Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	3bfc965	2026-10-17T12:29:29.527Z	Visit the dashboard ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	3d4d4d6	2026-10-17T12:13:11.167Z	Visit the dashboard ↗

[aakashns]

Done:

• Checkbox on "Create your vault": "[ ] Unlock with Touch ID" under the password boxes, only on Macs that can use Touch ID. Unticked at first; a click or Ctrl+T ticks it (Ctrl+T is shown in the hint bar).
• Cancel message: now just "Touch ID cancelled."
• Unlock button: it always says "Unlock" again. Touch ID has its own button to the right of it. Your message cut off after "replaced it with", so I read it as wanting both buttons. Tell me if you meant something else.

[aakashns]

The ticked box now shows a tick: "[✓] Unlock with Touch ID".