Two questions, one lock
Confidentiality asks: can a stranger read this? Integrity asks: is this still the thing I saved? A password manager needs both. A login that was secretly edited is not safer just because it was once hidden.
Authenticated encryption produces ciphertext plus a tag. When you unlock, the app checks the tag. If the check fails, the record should be rejected, not quietly trusted.
The Stax Pass version
XChaCha20-Poly1305 is an authenticated-encryption design. ChaCha20 hides. Poly1305 authenticates. Stax Pass applies that on the device before sync.
That is why we talk about sealed records instead of “the cloud is safe.” The cloud can hold sealed boxes. It should not need to read them.
Limits you can repeat out loud
A sealed box does not stop you from handing someone the opened letter. It does not stop a fake website. It does not create a support backdoor, and it should not. If you lose both the password and the recovery phrase, the seal stays shut. That is the trade.
Say it in one breath: the manager seals what you save; you still decide where you type. That sentence is more useful than any algorithm name at a dinner table, and it is the one we want people to leave with.
Is this worth paying for?
Notes apps encrypt in ways that vary and are often unclear. Paying for a manager is paying for a known seal and an honest recovery story. Stax Pass is a small monthly price after 45 days free. You are buying both the lock and the sentence that says what it cannot do.
Take this with you
- Hide and check. That pairing is authenticated encryption.
- Stax Pass seals records on the device with XChaCha20-Poly1305.
- Seals do not undo secrets you give away.
Common questions
Is this the same as a checksum?
It is a cryptographic tag tied to the encryption key, not a simple fingerprint anyone can recompute.
What happens if a record fails the check?
It should not open as if nothing happened. Failed authentication is a stop sign.
Does this replace unique passwords?
No. Unique passwords limit blast radius between sites. Sealing protects the stored copy. You want both.