Does our journal app know your password? Argon2id, the pepper, and where your key lives

The short answer: no. Your password never reaches our server, not when you sign up and not when you log in. Your device turns it into two different things, sends us one, and keeps the other. This post follows your password step by step: what Argon2id does to it, what the pepper protects and what it doesn't, and exactly where the key to your writing lives.

The last post named the methods. This one opens the first of them.

What happens when you sign up

Everything below happens on your device, in the app, before anything is sent.

1. Your device makes two random salts, and a random master key: 32 random bytes that will lock everything you write.
2. Argon2id turns your password and the first salt into a login proof.
3. Argon2id turns your password and the second salt into a lock key.
4. The lock key locks the master key.
5. Your device sends us your email, your username, the login proof, both salts, and the locked master key.

What it doesn't send: your password, the lock key, or the unlocked master key.

What happens when you log in

1. You type your username or email. Our server sends back your two salts. If no account exists, it sends back salts that look just as real, so the login page can't be used to find out who has an account.
2. Your device runs Argon2id twice again, with the same salts, and gets the same login proof and the same lock key.
3. It sends the login proof. If it matches, our server signs you in and sends back your locked master key.
4. Your device opens the master key with the lock key. Only now can your entries be read, and only on your device.

The two salts are why the proof and the key never meet. Same password, different salt, completely unrelated results. Nothing we store can be turned into your lock key.

Argon2id: making every guess expensive

Argon2id is the step that turns your password into the proof and the key. We run it with 19 MiB of memory and two passes each time, the baseline that OWASP, a well-known open security community, recommends.

You feel that as a short pause when you log in. Someone trying to guess your password feels it on every single guess. Guessing machines get their speed by running thousands of guesses side by side, and needing 19 MiB of memory for each one limits how many fit at once.

The pepper: what it protects, and what it doesn't

When the login proof arrives, our server doesn't store or compare it as it is. It first mixes it with a secret of its own, the pepper, and only that result is kept. The pepper lives in the server's configuration, not in the database, and it's backed up separately under its own passphrase.

What it protects. The stored proofs. Someone who copies our database can't use them to test guesses, and can't use a copied proof to sign in as you, because the server peppers whatever it receives.

What it doesn't. Your locked master key sits in that same database, next to its salt. Someone with a stolen copy could try passwords against that lock on their own computer, with no rate limit, and each wrong try would simply fail to open it. The pepper doesn't stand in the way of that. What does is Argon2id, which makes every try cost a full run, and the length of your password. We said this in the post about the builders. Two other posts said a stolen database "can't even start guessing", which was wrong, and we've corrected them.

Where your key lives

There are three keys in this story, and each one lives somewhere different.

• The lock key is made fresh on your device each time you type your password. It's used once, to open your master key, and then it's gone. It is never sent and never stored.
• The master key, locked, is on our server. It's a sealed box we hold for you and can't open.
• The master key, unlocked, lives only in the browser tab you're using, in its session storage. It belongs to that tab alone: open the app in a new tab and it asks for your password again, because the new tab starts without it. Closing the tab clears it, though a browser that reopens closed tabs can bring it back along with the tab.

Two more cases:

• Backups you download are locked with a key made from your password and a fresh salt for each file, so no two backups share a key.
• If you sign in with Google or Apple, they confirm who you are, but they never touch your key. At sign-up you choose a separate vault passphrase, and it does the password's job for your key. We never see it either, and we can't recover it.

The honest limits

• While the tab is open, the key is in that tab. Anyone or anything that can act inside that open tab can read what you can: someone at your unlocked computer, or a browser extension you've allowed to read every page.
• No password, no recovery. We don't have your key, so we can't hand it back. The forgotten-password post explains why.
• In a full breach, your password's length decides. Argon2id makes guessing slow. It can't make a short, common password safe.

What you can do

• Use a long, unique password. A short sentence works well. Don't reuse it anywhere.
• On a shared or borrowed computer, sign out and close the tab when you're done.
• Be choosy about browser extensions that ask to read and change data on every website.

Check it yourself

• Your password never leaves. On a computer, open your browser's developer tools (F12), go to Network, and log in. Click the request named verify and look at what was sent. You'll see a long value starting $argon2id$v=19$m=19456,t=2,p=1$. That's the login proof, with its settings written in it. Your password isn't there.
• Where the unlocked key sits. In the same tools, open Application → Session storage. While you're signed in you'll see an entry named aj.mk: that's your unlocked master key. Never paste it anywhere, and nobody from us will ever ask for it. Close the tab, open the app in a new one, and the app asks for your password again.
• Both Argon2id runs, in the code. Our encryption code is public on GitHub. The two runs, with their two salts, are in crypto/crypto.js.

Quick answers

Does Awaken Journal store my password?

No. Your device turns your password into a login proof and a lock key with Argon2id. We receive only the proof, and we store it mixed with a server secret called a pepper. Your password itself never reaches us.

What is a pepper in password hashing?

A secret the server mixes into a stored password check, kept outside the database. Unlike a salt, it isn't stored next to what it protects, so a copied database doesn't contain it.

What's the difference between a salt and a pepper?

A salt is random, stored openly, and different for every account; it makes each result unique. A pepper is one secret for the whole server, kept out of the database; it makes the stored checks useless without it.

Where is my encryption key stored?

Locked, on our server, where we can't open it. Unlocked, only in the session storage of the browser tab you're using, which belongs to that tab alone. The key that opens it is made from your password each time and never stored.

Can a stolen database be used to guess my password?

Slowly. The stored proofs can't, because of the pepper. The locked master key can be tried against guesses, but each guess costs a full Argon2id run, so a long, uncommon password keeps it out of reach.

Where to go next

The next post in Chapter 2 follows your words instead of your password: where they're sealed on your device, on a second device, and on the way to us.