Credential derivation
The browser uses Argon2id to derive a master key from the owner’s PIN or password. The server stores the KDF salt and parameters, but not the derived key.Vault item encryption
Each vault item uses a data encryption key. The data encryption key encrypts the item content, and the master key encrypts the data encryption key.Credential rotation
Credential rotation re-derives key material and re-encrypts vault item keys. It also regenerates recovery shares while preserving the intended recovery model.Changing your credential does not upload the plaintext master key to the server.