Lost or stolen device

What to do, what it fixes, and — the part most guides skip — what it does not.

Do this now, from another device you still have: open Pollis, go to Security in the sidebar, find the missing device under Devices, and press Revoke. You will be asked to type the device's name to confirm.

That single action removes the device from every conversation you are in and rotates the encryption keys, so it cannot read anything sent afterwards. It also stops the device authenticating to our servers at all, from the very next request.

If that device was your only device, skip to "If it was your only device" — the answer is different and more drastic.

What revoking actually does

Revocation is not a flag someone might ignore. Four separate things happen:

It is removed from every conversation's encryption group. Your revoking device immediately issues a removal for each group and DM you share, and that removal rotates the group keys. This is the part that matters: the removed device cannot derive the new keys, so messages sent after the removal lands are unreadable to it. Forever, not until it reconnects.
It can no longer authenticate. Every request to our Delivery Service is signed by the device, and the server checks the revocation tombstone before accepting a signature. The cached copy of that device's key is evicted at the moment of revocation, so this takes effect on the next request rather than when some timer lapses.
Its leftover credentials are deleted. Its unclaimed key material and its delivery cursor are removed in the same transaction, so it cannot be silently re-added to a group by material it published earlier.
Other members enforce it too. If your removal never lands — you go offline mid-revocation, say — every other member's app re-checks the roster on launch and reconnect, and will perform the removal itself. It does not depend on your device staying online.

You cannot revoke the device you are currently using; log out instead. That restriction is deliberate, and it is why a second device matters.

What someone holding the device can still get

This is the honest part, and it is the reason to act on the thief's device as well as on your account.

Your existing history on that device: yes, if they get past the PIN

Revocation is a forward-looking control. It cannot reach into a machine you no longer hold and delete anything — there is no remote wipe, and the sign-out that a cooperative device performs deliberately leaves local data in place.

The messages on that device are stored in a database encrypted with AES-256. The key to it is not on disk in usable form: it is sealed with a key derived from your PIN using a deliberately slow function, and the sealed blob lives in the operating system's keychain. So the practical question is whether an attacker can read that keychain.

If they can — because they know your computer's login password, or found it unlocked — then a four-digit PIN is on the order of an hour of computation to search exhaustively. The ten-attempt limit inside the app bounds someone typing at the screen; it does not bound someone working offline against a copy of the disk. If they cannot read the keychain, the database is indistinguishable from random noise and the history is safe.

The action that follows from this is simple and it is not about Pollis: change your computer's login password and make sure full-disk encryption is on. A longer PIN helps too.

New messages: no

Once the removal commit lands, the device is outside the group and the keys have moved on. There is a window — between your revocation and each member's app processing it — in which it still holds the previous keys and can read anything sealed under them. Members who are online close that window in seconds; a member whose device is offline closes it when they next open the app.

Encrypted traffic: a revoked device stops being served at all

A revoked device cannot fetch anything after revocation — not messages, not metadata. Every request to the Delivery Service, reads included, is signed by the device’s own key, and a revoked device’s signature is refused. The app holds no database credential of any kind, so there is nothing to fall back on.

What a revoked device keeps is whatever it already downloaded before revocation, sitting in its local encrypted database. It cannot decrypt anything sent afterwards, because the group rekeys without it.

One thing revocation does not do, that you might expect

Your contacts are not notified. Safety numbers in Pollis identify a person, not a device — every device chains to one account identity, which is what lets you verify someone once instead of once per device. Revoking a device does not change that account identity, so nobody's safety number changes and no key-change warning appears for anyone you talk to. If you want your contacts to see something, you have to tell them.

Your own security log does record it

Revoking a device writes a Device revoked entry to Settings → Security, alongside the enrollments and rejections already logged there, naming the device and the time. That is the answer to the question this whole page exists for — "did it actually take effect?" — and it does not depend on the device you revoked ever coming back online. Until recently it was not recorded at all, and this page said so.

If it was your only device

There is no way to revoke a device from itself, and no second device to do it from. The only remaining path is a full identity reset, performed from a new device at the sign-in screen — the link reads "I've lost my Secret Key — reset my account". You confirm by typing your email address.

This is genuinely destructive, and you should know the price before you start:

Every other device is removed, including the lost one.
You leave every group and DM. Admins can invite you back; you do not rejoin automatically.
Your message history does not come with you. There is no key backup and no server-side copy of your history, by design. A new device starts empty. That is one of the small number of deliberate, disclosed limits in Pollis — the price of us never holding a key that could restore it.
Your account identity changes, so your contacts will see a key-change warning. Expect to re-verify with anyone who checks safety numbers.

One thing to be aware of: this path is gated on receiving a one-time code by email and typing your own address. Whoever controls your email account can therefore trigger it. Securing that mailbox is worth more than any setting inside Pollis.

If you think someone read your messages

Revoking handles the device. If you suspect the compromise went further — someone had your account, not just your hardware — the reset above rotates your account identity and is the stronger move, at the cost of your group memberships and history.

If you have found a weakness in Pollis itself rather than lost a laptop, please report it privately through a GitHub security advisory; the machine-readable policy is at /.well-known/security.txt.