Why your password never leaves your device

Most services check your password by receiving it and comparing a hash. Even when the hash is salted and slow, the plaintext still crosses the wire and sits in server memory for a moment. HushOS does not do that.

What OPAQUE does

OPAQUE is a password-authenticated key exchange. During registration your browser and the server run a short protocol that leaves the server holding a record it can use to verify a later sign-in, without ever learning the password itself. At sign-in the browser proves it knows the password; the server proves it holds the matching record. Neither side sends the secret.

Password sent to server

Never

Server stores

An OPAQUE registration record

Client derives

An export key, used only on the device

Hardening

Argon2id, 64 MiB, 3 iterations

Why it matters for an encrypted suite

The export key that OPAQUE gives the browser is what protects your account key. That account key is a random 32 bytes generated on your device. It is wrapped by a key derived from the OPAQUE export key and separately by a key derived from your 24-word recovery secret. Changing your password rewraps the same account key and leaves your recovery phrase and identity keys unchanged. Drive file encryption is still future work.

Changing your password or keys

In Account settings, changing a password starts with a fresh OPAQUE proof of the current password. Your browser registers the replacement password and rewraps the account key under the new export key. Neither the current password nor the new one is sent to the server. The server updates the encrypted bundle and authentication record together, revokes existing sessions, and your browser signs in again.

If you have forgotten your password, recovery instead requires a verified email link and your 24 words. That reset preserves the account key but replaces the recovery phrase. Save the new phrase after recovering.

You can also rotate the recovery key or the master key from Account settings. Recovery-key rotation replaces the 24 words while preserving your password and account key. Master-key rotation replaces the account key and recovery phrase while rewrapping the existing identity keys and your workspace grants; the workspace keys themselves never change. Both require your current password and revoke existing sessions.

The security model explains these operations and why rotation cannot erase old key bundles or secrets someone already copied.

Where to read the code

The protocol lives in the @hushos/crypto package, with the versioned envelope formats documented in docs/opaque-auth-design.md. Everything in this post is checkable there.