One read of Claude Documentationclaude-docs-20261106T230708Z
2 pages moved out of 281 read.
Pages moved
2
significant first
Pages read
281
in this capture
Captured
23:07 UTC
Corpus hash
5728919aec1c
corpus-hash
What this read moved
1-2 of 2third-party/claude-desktop/data-storage Changed · +4 / -1 lines
from line 44
4444
4545Other standard OS accounts on the same machine can't read the files in this directory, but administrators can. On macOS and Linux, the app creates the directory with owner-only permissions. On Windows, the directory takes the permissions of the user's profile.
4646
47Apart from the user's sign-ins to plugin servers on Windows and Linux, the app encrypts stored sign-in tokens, API keys saved from the in-app configuration window, and similar secrets with the operating system's secure storage (see [Credentials](#credentials)). It doesn't encrypt conversations, settings, the rest of the locally applied configuration, or, on Windows and Linux, the user's sign-ins to plugin servers. Protection at rest for those files depends on the device's full-disk encryption, such as FileVault or BitLocker.
47The app doesn't encrypt conversations, settings, or the locally applied configuration other than its API keys. On Windows and Linux, it also doesn't encrypt the user's sign-ins to plugin servers or secret plugin settings entered in **Code**. Protection at rest for those files depends on the device's full-disk encryption, such as FileVault or BitLocker. The app encrypts some credentials with the operating system's secure storage, such as API keys saved from the in-app configuration window and the OAuth tokens of managed MCP servers (see [Credentials](#credentials)).
4848
4949The logs directory contains `main.log` (application and configuration-validation events), `ssh.log` (SSH connection events), `cowork_vm_node.log` (sandbox VM activity), `claude.ai-web.log` (renderer events), and `mcp.log` / `mcp-server-<name>.log` (MCP connection events).
5050
from line 112
112112 * **macOS**: the login keychain, or that file if the keychain rejects the write
113113
114114 The tokens from a sign-in in **Code** are in [Claude Code's own credential store](https://code.claude.com/docs/en/authentication#credential-management).
115* **Secret plugin settings**: a plugin can ask the user for a value that it marks as sensitive, such as an API key. A value entered in **Code** is in [Claude Code's own credential store](https://code.claude.com/docs/en/authentication#credential-management):
116 * **Linux, and Windows by default**: an unencrypted file
117 * **macOS**: the login keychain, or that file if the keychain rejects the write
115118* **Credential-helper output**: held in memory for `inferenceCredentialHelperTtlSec` seconds, then discarded and re-fetched.
116119
117120### Transient credential files
third-party/claude-desktop/configuration Changed · +1 / -1 lines
from line 1139
11391139>
11401140> Each entry is a model ID string or an object:
11411141>
1142> ```json theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null} theme={null}
1142> ```json theme={null}
11431143> [
11441144> {"name": "claude-sonnet-5",
11451145> "supports1m": true},