New locks, same home
If every box in the attic is glued to one brand of padlock, a problem with that padlock becomes a moving day. If each box is labeled with which lock it uses, you can re-lock over time. You do not throw away the attic. You plan the change.
That is crypto agility in daily language: keep the method explicit, keep versions clear, and leave room to introduce a stronger protection or stop using a weaker one. It is maintenance, not restlessness. Good houses get new locks. They do not pretend the first lock is eternal.
The problem this solves in a password manager
You may keep a password manager for years. Research moves. Hardware gets cheaper for attackers. A method that is sound today may need a successor. A product trapped on a single unnamed choice has a harder future. A product that documents what it uses can explain a change without mystery.
Agility also fights a marketing trap. “We will never need to change” is not a virtue in cryptography. “We can change without losing track of your records” is. You want a manager that can respond, not one that bets your attic on a permanent gadget.
What Stax Pass documents today
Today, Stax Pass encrypts records on the device before sync with XChaCha20-Poly1305, a method that keeps contents private and helps detect changes. Password-based protection uses Argon2id, a memory-hard function that derives keys from a password. Sign-in uses OPAQUE (RFC 9807), a password-authenticated key exchange that proves you know the password without leaving a reusable server secret. Recipient-bound protection uses HPKE, a standard way to lock data to one public key, with X25519, a public-key operation for shared secret material, and HKDF-SHA-256, a method that derives separate keys for separate jobs.
Naming those pieces is part of agility. You cannot upgrade a mystery. The security guide exists so current decisions are understandable, and so a later change can be described in the same plain language. Agility is a process. The names are the inventory.
What you still have to do
Keep the app updated. A lock catalog does not help if the door still runs last year's software. Updates are how a safer method actually reaches your phone. Ignoring them is like leaving the old cylinder in the door after the locksmith visited.
Keep reading the security details when they change. You do not need a degree. You need to know whether recovery still lives with you, whether encryption still happens before sync, and whether support still has no spare key. Agility should make those answers clearer over time, not vaguer.
Honest limits
The ability to change algorithms does not stop phishing. It does not restore a stolen recovery phrase. It does not protect an unlocked laptop on a cafe table. Agility is about the life of the cryptography, not about a force field around human mistakes.
Agility also is not a reason to shrug at today's choices. A product should pick studied tools now and remain able to move later. “We might change it someday” is not a substitute for naming what protects your records this week. Ask for both: a clear present, and a path to a careful future.
Is this worth paying for?
A $0.99 family plan is a small monthly cost for a manager you may use for a long time. Stax Pass names its current cryptography, encrypts on the device before sync, and is built so those choices can be understood and updated. The 45-day free trial needs no credit card. You are not paying for a claim that the first lock is perfect forever. You are paying for a house that can change locks without abandoning the rooms.
Take this with you
- Crypto agility means a product can evolve its cryptographic tools instead of being trapped by one permanent choice.
- Stax Pass names its current methods so they can be understood now and updated later with a clear inventory.
- Updates still matter, and agility cannot stop phishing or a recovery phrase stored in the open.
Common questions
Does crypto agility mean Stax Pass will change algorithms without telling anyone?
Agility should make changes explainable, not silent. The point of naming the record lock, the memory-hard password function, the private sign-in protocol, and the recipient-bound wrapping tools is that current choices are visible. A responsible update is one you can read about in ordinary language.
If a method is standard, why would it ever need to change?
Standards are studied, not frozen in amber. Computers get faster. Researchers find new attacks. Better options appear. A password manager used for years should be able to follow that evidence.
Do I need to pick the algorithms myself?
No. Your job is to update the app, protect your password and recovery phrase, and read the security guide when you want the inventory. Algorithm choice is engineering. Clarity about that choice is part of trust.