ChatGPT Locked Chats Are Not an Encrypted Vault. What Does the PIN Actually Protect?
ChatGPT Locked Chats hide saved conversations behind a PIN, but they do not change encryption, retention, training, memory, or compliance boundaries.
Short answer: ChatGPT Locked Chats add useful privacy against someone casually seeing a sensitive conversation on your screen or shared device. They do not create end-to-end encryption, a separate encrypted vault, shorter retention, a different model-training choice, or immunity from workplace compliance logging. The PIN controls access to a saved chat; it does not turn that chat into data OpenAI cannot process or retain.
Research cutoff: October 21, 2026. This article reviews OpenAI's October 20 Locked Chats documentation and release notes, its current retention guidance, and current independent coverage. The feature is rolling out gradually, so availability and behavior may change.
ChatGPT Locked Chats in One Minute
OpenAI began rolling out Locked Chats on October 20. An eligible saved conversation can be moved out of regular history, pinned chats, and regular conversation search. Opening the locked area requires a four-digit account PIN or, on supported mobile devices, Face ID, Touch ID, or the device unlock method.
That is meaningful protection when you share a screen, lend someone your device, or want a second access check inside an already signed-in ChatGPT account.
But OpenAI's own Locked Chats guide draws a bright line around the feature. Locking a chat does not:
- create end-to-end encryption;
- create a separate encrypted vault;
- change how long OpenAI retains the conversation;
- change the Improve the model for everyone setting;
- remove information ChatGPT remembered before the lock;
- override workspace policy, safety requirements, or legal obligations; or
- remove an existing shared link to the conversation.
The best description is therefore an account-level visibility and access control for saved chats. It is not a new data-processing boundary.
What Is Confirmed
Locked Chats hide selected conversations from the ordinary account view
OpenAI says a locked conversation leaves regular history, pinned chats, and regular conversation search. It appears under Projects > Locked chats, where its title remains hidden until the user authenticates.
The control is aimed at a practical threat: another person can already see your unlocked device or signed-in ChatGPT screen. A PIN or supported biometric check can stop that person from opening the protected conversation through the normal interface.
This does not mean the title vanishes everywhere instantly. OpenAI warns that search results can take time to update, other devices that are already open may show the old title until their conversation lists refresh, and previously loaded iOS content may remain visible until the app refreshes. On the web, the chat can also remain open in the tab where it was locked.
The immediate checklist is simple: lock the chat, refresh or close already-open sessions, check other devices, and use Lock now before handing over the screen or device.
One four-digit PIN is tied to the OpenAI account
The account PIN is not unique to each chat and is not tied to one workspace. The same PIN works on supported devices signed into the same OpenAI account. Device authentication is enabled separately on each device, while the PIN remains available as a fallback.
Changing a known PIN keeps the locked conversations. Resetting a forgotten PIN is radically different: OpenAI says a reset permanently deletes every locked chat, memories stored only within locked chats, and files or other content protected only by the old PIN. OpenAI Support cannot recover them.
That destructive reset is an account-recovery design choice. It is not evidence that each chat is encrypted with the four PIN digits, and OpenAI explicitly says Locked Chats are not a separate encrypted vault.
Locked Chats keep their normal retention rules
OpenAI's current chat and file retention guidance says regular and archived chats remain saved until the user deletes them or an applicable workspace policy removes them. Locked Chats do not get a shorter retention period merely because they are behind a PIN.
When a user deletes a saved chat, OpenAI says it disappears from the account view immediately and is scheduled for permanent deletion from its systems within 30 days, unless it was already de-identified and disassociated from the account or must be kept longer for security or legal reasons.
Locking and deleting are therefore different operations:
| Action | Main purpose | Saved in the account? | Changes normal retention? |
|---|---|---|---|
| Lock | Hide and require account PIN or supported device authentication | Yes | No |
| Archive | Organize a chat outside the main history | Yes | No |
| Delete | Remove from the account view and start the documented deletion process | No | Yes |
| Temporary Chat | Start with different history, memory, and model-improvement behavior | Not in normal history unless saved | Yes, under Temporary Chat rules |
A user who wants future access should consider a lock. A user who wants the provider to begin deletion should delete. Those goals are not interchangeable.
Locking does not change the model-improvement setting
Locked Chats follow the account or workspace's existing data-use settings. OpenAI says locking a conversation does not change Improve the model for everyone.
For a personal account, a user should review that setting separately. For Business, Enterprise, and Edu workspaces, OpenAI says business data is not used to train its models by default. The lock itself does not create either policy.
This distinction matters because a privacy label inside the interface can feel broader than it is. Who can open the chat on this account and whether content may be used for model improvement are two different questions controlled in different places.
Locked Chats have a separate but connected memory boundary
When Memory is enabled, OpenAI documents a nuanced arrangement:
- locked conversations can use relevant information from regular Memory;
- new messages sent after locking can create memory for use in other locked conversations;
- information remembered only inside Locked Chats does not carry into regular chats;
- locking does not remove information remembered before the lock;
- permanently unlocking can make the full conversation eligible for regular Memory again; and
- memories created while locked are not automatically copied into regular Memory when the chat is unlocked.
So the wall is asymmetric. Regular Memory can inform a locked conversation, while new locked-chat memory stays inside the locked area. Anything remembered before the lock can remain in regular Memory.
If the goal is to remove a sensitive fact that ChatGPT already remembered, locking the source conversation is not enough. Review and delete the relevant saved memory, delete or manage the source chat as appropriate, and then test future personalization. OpenAI also warns that memory summaries and sources may not expose every factor that shaped a response.
Existing shared links survive the lock
OpenAI says an otherwise eligible chat can be locked even if it already has a shared link. Locking does not delete that link. Content already shared through it remains available, although new messages sent after the conversation is locked are not added to that existing share.
That creates two separate access paths:
- the signed-in account path protected by the Locked Chats PIN; and
- the previously issued shared-link path governed by the share control.
If public or recipient access should stop, delete the shared link separately. A lock is not a recall mechanism for a link, screenshot, copied passage, export, or recipient-owned copy.
Enterprise and Edu compliance logs still include locked conversations
OpenAI's Enterprise and Edu release notes say Locked Chats remain included in conversation message logs available through the OpenAI Compliance Platform. Organization retention policies and compliance requirements still apply.
Workspace administrators cannot unlock a member's Locked Chats or reset the account PIN. That protects the ordinary user-interface access path. It does not erase the organization's authorized compliance access to eligible workspace data.
Employees should not treat the lock as a way to make a business conversation invisible to records, legal, security, or compliance processes. The feature protects against casual viewing, not authorized organizational governance.
Not every conversation can be locked
OpenAI lists several ineligible categories, including Temporary Chats, archived chats, group chats, chats created from a shared link, conversations with scheduled tasks, meeting recordings, background tasks, and responses saved as project sources. Codex conversations and local Work conversations cannot be locked. ChatGPT for Healthcare does not offer the feature.
Availability is also gradual. A missing Lock chat menu item may mean the rollout has not reached the account, the platform is not yet supported, or that conversation type is ineligible.
What Is Still Unclear
What the PIN protects cryptographically
OpenAI clearly says the feature is not end-to-end encryption or a separate encrypted vault, but its public guide does not provide a low-level cryptographic design. It does not say that the four-digit PIN derives an encryption key that makes server content unreadable to OpenAI.
The defensible conclusion is limited: the PIN gates access through supported ChatGPT interfaces. It should not be described as client-side encryption, zero-knowledge storage, or proof that the provider cannot read or process the conversation.
How every cached interface updates during rollout
OpenAI warns that search, sidebars, already-open devices, and loaded iOS content may update at different times. It does not publish one maximum refresh time for every client or offline cache.
Users with a high-stakes screen-sharing need should test the exact web, desktop, iOS, and Android devices involved. A setting that is correct on one client is not proof that every already-open surface has refreshed.
The complete boundary around protected files
Files uploaded or created inside a locked conversation are protected with that chat. But files added from elsewhere in Space keep their existing access rules, files from connected sources keep their source rules, and deleting a conversation does not necessarily delete a separate file that remains in Space or Library.
The user-visible rule is documented; the complete service-by-service storage architecture is not. Before treating a file as protected, inventory where it exists: the chat, Space or Library, a connected drive, a download folder, a recipient's copy, or another application.
Whether future product changes will broaden eligibility
The first release excludes several conversation types and ChatGPT for Healthcare. OpenAI does not promise in the reviewed material that each exclusion is permanent or publish a universal expansion timeline.
An eligible feature today can also gain new integrations later. Privacy-sensitive users should recheck the guide after material ChatGPT changes rather than assuming the October 20 boundaries remain fixed.
Locked Chat vs Temporary Chat vs Deletion
These options solve different problems.
Use Locked Chats for local viewing privacy with future access
Choose a lock when you want to keep a saved conversation but reduce the chance that someone with access to your signed-in screen or device can casually find and open it.
The chat stays saved. The normal retention and model-improvement settings continue. Memory follows the special Locked Chats rules. Workspace compliance access can still apply.
Use Temporary Chat for a different history and memory mode
OpenAI says Temporary Chats stay out of ordinary history, do not create or update memories, and are not used to improve its models. OpenAI may keep a copy for up to 30 days for safety purposes. A Temporary Chat cannot be locked while it remains temporary; saving it converts it into a regular chat.
Temporary Chat is closer to a data-minimization choice at conversation start. Locked Chats are a future-access and screen-privacy choice for saved conversations.
For a deeper comparison, see ChatGPT Temporary Chat vs browser-local AI history.
Use deletion when continued storage is not the goal
Deleting starts the documented removal process. It is the appropriate account action when the user no longer wants the chat saved, subject to the stated 30-day, de-identification, security, and legal exceptions.
Deletion also needs a copy inventory. A chat can leave behind saved memories, a shared link, files retained in another location, connected-service records, exports, screenshots, or recipient copies. OpenVeil's guide to deleting a ChatGPT chat, connector data, and saved memory explains why one delete button rarely reaches every related record.
A Practical Locked Chats Privacy Checklist
Before locking
- Check whether the conversation already has a shared link.
- Identify files saved separately in Space, Library, a connected source, or your device.
- Review whether ChatGPT already placed sensitive details in regular Memory.
- Confirm that the conversation is eligible and has no scheduled or background task attached.
- Decide whether your real goal is continued access, temporary use, or deletion.
Immediately after locking
- Verify that the conversation left regular history, pins, and search.
- Refresh or close other ChatGPT tabs and app windows.
- Check other signed-in devices that were already open.
- Use Lock now before sharing the screen or device.
- Confirm that the old shared link is deleted if recipient access should end.
For personal accounts
- Review Improve the model for everyone separately.
- Review regular Memory and the Locked Chats memory behavior separately.
- Remember that the account PIN is shared across supported devices on that OpenAI account.
- Store the PIN safely; resetting a forgotten PIN deletes all protected content.
- Do not treat a four-digit PIN as end-to-end encryption.
For work or school accounts
- Assume authorized retention and compliance policies still apply.
- Ask whether conversation logs are collected through the Compliance Platform.
- Do not use the feature to evade records, legal-hold, investigation, or acceptable-use requirements.
- Confirm how the organization handles files, exports, connected apps, and retention.
- Separate administrator inability to unlock the user interface from authorized compliance access to message logs.
Before entering highly sensitive material
- Minimize names, identifiers, credentials, health details, legal strategy, and confidential business data.
- Consider whether a narrower question can be answered without the raw sensitive record.
- Prefer a workflow whose storage and provider boundaries match the task before sending the first message.
- Keep account security, device encryption, operating-system access, and browser hygiene strong. A chat-level PIN cannot compensate for a compromised account or device.
Where OpenVeil Fits, and Where It Does Not
Locked Chats improve privacy inside ChatGPT's saved-history model. OpenVeil takes a different approach for normal chat history: it stores that history in the user's browser rather than maintaining a normal server-side chat-history account record. OpenVeil's documented product content, including prompts, uploads, selected history, media, and outputs, is not used to train foundation models.
That can be a better fit for adults who want a hosted conversational workspace without building a permanent normal server-side chat archive. The tradeoff is that browser-local history depends on the browser profile, origin storage, backups, device access, and user deletion practices. Clearing site data or losing the profile can remove history, while other local copies or backups can outlive the active browser record. See what browser-local chat history means for the full boundary.
Active OpenVeil requests still require processing by OpenVeil and necessary providers. OpenVeil is not fully offline, anonymous, zero-log, end-to-end encrypted chat storage, a password vault, a device-security product, a ChatGPT privacy control, or a guarantee against account compromise, screenshots, exports, or recipient copies.
The useful comparison is not “PIN or no privacy.” It is:
- ChatGPT Locked Chats: saved provider-side conversation with an additional account access gate;
- ChatGPT Temporary Chat: temporary conversation with different history, memory, and improvement behavior;
- OpenVeil normal chat: browser-local history with active hosted processing; and
- fully local AI: local model and storage when configured without cloud calls, with the user responsible for the device and software stack.
Choose based on the storage, access, recovery, provider, and deletion boundary you actually need.
Frequently Asked Questions
Are ChatGPT Locked Chats end-to-end encrypted?
No. OpenAI explicitly says locking a chat does not create end-to-end encryption or a separate encrypted vault.
Does locking a ChatGPT conversation stop OpenAI from retaining it?
No. The chat remains saved and follows the normal retention policy or applicable workspace policy. Locking and deleting are separate actions.
Does a locked chat stop model training?
Not by itself. Locked Chats follow the existing Improve the model for everyone setting. Business, Enterprise, and Edu data-use defaults are separate product policies.
Can a locked chat use my regular ChatGPT Memory?
Yes, if Memory is enabled. OpenAI says Locked Chats can use relevant regular Memory. New information remembered only after locking stays within the locked area and does not carry into regular chats.
Will locking a chat erase something ChatGPT already remembered?
No. OpenAI says locking does not remove information remembered before the chat was locked. Manage saved memory and the source conversation separately.
Does locking a ChatGPT chat disable its shared link?
No. Previously shared content remains available through an existing link until that link is deleted separately.
Can my employer or school administrator read a locked chat?
Workspace administrators cannot unlock it through the normal interface or reset the PIN. However, Enterprise and Edu locked conversations remain in message logs available through authorized OpenAI compliance tools, and organization policies still apply.
What happens if I forget the Locked Chats PIN?
Forgetting it does not immediately delete anything. Resetting it permanently deletes all locked conversations, memories stored only there, and content protected only by the old PIN. OpenAI says the deletion cannot be undone.
Is Face ID safer than the four-digit PIN?
It can reduce casual exposure on a supported device, but device authentication is optional, configured per device, and does not replace the account PIN. Neither method turns the chat into end-to-end encrypted storage.
Can I lock a Temporary Chat or scheduled task conversation?
No. OpenAI lists Temporary Chats, chats with scheduled tasks, and several other categories as ineligible. Saving a Temporary Chat converts it into a regular chat before it can follow regular saved-chat behavior.
Is OpenVeil the same as a locked-chat vault?
No. OpenVeil's normal conversation history is browser-local, while active requests are hosted and processed by OpenVeil and necessary providers. It is not an encrypted vault or a control for ChatGPT data.
Bottom Line
ChatGPT Locked Chats solve a real, narrow problem: they make selected saved conversations harder to discover or open when another person can see your signed-in screen or use your device. The PIN, biometrics, hidden titles, separate search area, and special memory compartment add meaningful local viewing privacy.
They do not solve every privacy problem that the word “locked” may suggest. The chat remains a saved ChatGPT record. Retention does not change. The model-improvement choice does not change. Preexisting memory can remain. Shared links require separate deletion. Enterprise compliance logs remain available to authorized tools. OpenAI can still process the content, and the lock is not end-to-end encryption.
Use Locked Chats when you want continued access plus a second interface gate. Use Temporary Chat when you want a different history and memory mode from the start. Use deletion when continued provider storage is not the goal. And before entering sensitive material, choose the architecture whose storage and processing boundaries fit the task rather than expecting one PIN to create a private vault.