The metal, not the nickname
You can shout “house key” across a yard. That does not turn the lock. The cut metal does. In a password manager, a cryptographic key is that metal: a long secret value the encryption method uses to lock and unlock a record. It is not a pet name. It is not “Password1.” It is not the login for your bank.
People mix these layers because they all feel like secrets. They are not the same job. Site passwords open websites. The manager password is how you, a person, prove you should open the cabinet. The cryptographic keys are what the software uses once it is allowed to work. Mixing them up leads to bad questions, like asking support to “just email me the key.”
The problem this solves in a password manager
Encryption needs keys. If those keys are weak, reused, or stored in the clear next to the lock, the lock is theater. A password manager has to create keys, keep them away from the readable records on the server, and still let you unlock on a new phone.
That is why you should care about keys even if you never see them. They decide whether a synced copy is a sealed box or a spare diary. They also decide whether recovery is something you hold, or something a company can mint on request.
How Stax Pass gets from a password to a key
You type a password. Stax Pass does not treat that password as the encryption key by itself. It uses Argon2id, a memory-hard function that derives cryptographic protection from the password while making each guess expensive. That derived material helps unlock later key layers on your device. The security guide maps those layers in ordinary language: password or recovery phrase, then deeper keys, then the records.
The records are encrypted with XChaCha20-Poly1305, a method that uses a key to keep contents private and to detect changes. Sign-in uses OPAQUE (RFC 9807), a password-authenticated key exchange that proves you know your password without depositing it as a reusable server secret. You still never have to handle the raw key bytes. Your job is the human secrets that unlock them.
What you still have to do
Protect the password that starts the chain. Make it long and unique. Do not reuse it on email or shopping sites. Protect the recovery phrase as a second start to the same chain. Those two human secrets are how a person is supposed to reach the metal keys.
Do not send “the key” to anyone who asks. Support will not need your recovery words to chat about a billing question. If a message asks you to paste keys, phrases, or unlock codes, stop. Open the real app yourself. Keys only work as secrets.
Honest limits
A strong key does not stop a phishing page. If you unlock the manager and paste a site password into the wrong form, the key did its job and the scam still worked. A stolen recovery phrase can start the chain without guessing. An unlocked device already has the door open.
Keys also cannot be reinvented by support if you lose both human secrets and have no unlocked device. That is the point of not keeping a spare. Cryptographic keys are powerful inside the software. They are not a force field around a person who has been tricked.
Is this worth paying for?
You are not paying to see keys on the screen. You are paying for a manager that derives them carefully, encrypts records on the device before sync, and refuses to hold a spare. Family plans start at $0.99 a month, with a 45-day free trial and no credit card. The small cost is for that key design—and for keeping the metal away from a company drawer.
Take this with you
- A cryptographic key is the secret material encryption uses; it is not the same as each saved website password.
- Stax Pass derives protection from your password with Argon2id, a memory-hard function, then uses those keys to encrypt records on the device.
- You protect the password and recovery phrase that unlock the keys; support cannot mint a replacement.
Common questions
Is my Stax Pass password the encryption key?
No. Your password is a human secret. Stax Pass uses Argon2id, a memory-hard function, to derive cryptographic protection from it. That is a feature: the software gets the shape of key it needs, and guessing the password is made more expensive.
Can I see the keys?
You should not need to. Handling raw keys by hand is how they leak into screenshots and chats. Your interface is the password, the recovery phrase, and the saved records. The keys stay inside the designed unlock path.
If keys are so important, why not let support keep a copy?
A copy held by the company is a copy that can be demanded, stolen, or misused. Stax Pass is designed so you hold the human secrets that unlock the keys. That is less convenient if both secrets are lost. It is more private while they are not.