Improved Vault

Vault: existing vaults now move onto stronger settings by themselves

A Vault kept the encryption settings it was created with. It now moves onto the current ones the next time you unlock it, without re-encrypting anything or affecting your recovery key.

Vault protects your Vault password with Argon2id, a deliberately slow and memory-hungry calculation that makes guessing your password expensive. The settings it uses are recorded alongside your Vault so they can be strengthened over time.

Until now they never were. A Vault kept whatever settings it was created with, so strengthening them would only ever have helped people who signed up afterwards.

Unlocking your Vault now checks those settings and quietly brings them up to date. It happens in your browser at the one moment it can - when your password and your keys are both already there - and it is only the protective layer around your key that changes. Your key itself is untouched, so nothing is re-encrypted, no item is rewritten, and your recovery key keeps working exactly as before. If it cannot be saved, your Vault still opens normally and it tries again next time.

Separately, Vault can now read items saved under older encryption formats rather than only the current one. Nothing you have saved is affected today, and this is what makes it possible to change the format later without stranding items that were saved before the change.