ChatGPT adds PIN lock for private conversations

How the new lock works

OpenAI has begun rolling out a privacy feature that allows users to secure individual conversations with a four-digit account PIN. This rollout is happening gradually, meaning the option may not appear for every user immediately.

The feature is designed to be accessible across multiple platforms. It works on the web, the iOS and Android apps, and the new ChatGPT apps for macOS and Windows. While most users can access it, ChatGPT for Healthcare is the only version excluded from this update.

On mobile devices, the system integrates with native security features. iPhone users can use Face ID or Touch ID instead of typing a PIN, while Android users can use their standard device unlock method. To activate these, users must navigate to the Security and login settings within their account.

Where locked chats go

Once a user selects the 'Lock chat' option from a conversation's menu, the chat undergoes a significant change in visibility. It is removed from the standard chat history, the sidebar, and the regular search function. Instead, these conversations are moved to a dedicated section called 'Locked chats' found under the Projects menu.

The behavior of these chats varies slightly depending on the device being used. On mobile apps, access to a locked chat will automatically end after one minute of being in the background. On a web browser, simply closing the tab or reloading the page will trigger the lock. Additionally, Android users will see a blank screen if someone attempts to take a screenshot of a locked conversation.

There are some limitations to what can be locked. Users cannot apply this feature to temporary chats, archived chats, group chats, chats with scheduled tasks, or any conversations created from a shared link.

The limits of the lock

It is important to understand that this feature is a visual barrier rather than a technical vault. As Notebookcheck reported, locking a chat does not create end-to-end encryption. This means the data is not scrambled in a way that prevents OpenAI from accessing it; it is simply hidden from the user's immediate view.

Furthermore, the lock does not change how OpenAI handles your data regarding model training. If a user has the 'Improve the model for everyone' setting turned on, a locked chat can still be used to train OpenAI's systems. Even if a chat is locked, any information the AI previously learned about the user through the 'Memory' feature remains active.

For users in Enterprise or Edu workspaces, the privacy is even more limited. Locked chats still appear in the message logs of the OpenAI Compliance Platform. Additionally, if a user's account is configured to show ads, those advertisements can still appear within the locked chat interface.

The risk of a lost PIN

The most significant risk for users is the lack of a recovery system for the PIN. If a user forgets their four-digit code, there is no way to reset it and regain access to the content. The only way to move forward is to perform a full reset, which permanently deletes all locked chats, any files protected by those locks, and any memories stored specifically within those chats.

OpenAI has stated that "OpenAI Support cannot recover the deleted content" in these instances. This means that while changing a PIN is safe if you know the current one, losing it is a permanent loss of data. Because of this, users should choose a PIN they can easily remember but that remains secure from others who might see them type it.

This feature is primarily intended for situational privacy. It helps a user who might be sharing a phone with a friend or someone planning a surprise who doesn't want a family member to see a specific conversation. It is not intended to be a secure storage solution for sensitive personal information or corporate secrets that require high-level security protocols.