Your master password is the root of vault access. It is not a second login we keep on file. On your device it feeds a key-derivation step that produces the material used to encrypt and decrypt vault items. The network stores sealed results of that process — not a recoverable copy of the password that started it.
That single fact explains most of the “inconvenient” parts of a serious password manager. It also explains why the model is worth the inconvenience.
Derivation, not upload
If a service stores your master password — even hashed in a conventional way for “login only” — the threat model shifts. Password hashes get attacked. Support tools get abused. Reset flows get social-engineered. Vault App is designed so the master password never becomes a server-side secret we can reverse or reset into vault access.
Keys are derived locally so encryption and decryption stay under your control. Unlocking is a cryptographic act on a device you trust, not a permission bit flipped in a remote admin panel.
The one password you must remember
Everything else in the vault can be long, random, and unique — generated and stored so you never memorize it. The master password is the exception. It should be strong, unused anywhere else, and memorable enough that you will not paint yourself into a corner.
If you need a backup of the master password, treat it like vault treasure: offline, access-controlled, not in an email draft and not in a plaintext note synced to every device you own. Losing it means losing the ability to decrypt. That is the same property that stops us from decrypting for someone else.
What sits behind the unlock
Passwords, secure notes, cards, generators, activity views — all of it inherits the unlock boundary. Get the root right and the rest of the product can stay sealed by default. Get the root wrong (reuse, sharing, weak patterns) and no amount of AES marketing will save the threat model you created.
We never store your master password. We never hold derived vault keys in a form that lets us read your items. Your job is to protect the one secret that makes that promise real. Ours is to never give ourselves a way around it.