Passwords

Storage

Directory: ~/.vault/

• vault.age — Encrypted entries, policy, policy integrity hash
• state.age — Encrypted session metadata and attempt tracking

All data encrypted at rest using age (ChaCha20-Poly1305).

Key Derivation

password → Argon2id (m=64MiB, t=3, p=4) → master_key → HKDF-SHA256 → subkeys

Subkeys: one for vault encryption, one for integrity verification, one for logs.

Master Password Setup