The old pattern, in a kitchen
Imagine a club that keeps a photocopy of your house key so they can check it at the door. Even if they lock the photocopies in a cabinet, the cabinet is now a target. Many internet services grew up on a version of that idea: store something derived from the password so they can check you later.
That can be done well or badly. Either way, the service is holding material tied to your password. OPAQUE was designed to avoid treating the password as a reusable server-side secret.
What OPAQUE changes
OPAQUE is a password-authenticated key exchange, published as RFC 9807. In plain language: you and the service run a protocol that only works if you know the password, and you end up with a protected session. The service is not supposed to be left with a simple “here is how to check every guess offline” file in the usual way.
You will not see a button labeled OPAQUE. You will feel a normal unlock. The value is in what is missing on the other side.
How this sits next to the vault lock
OPAQUE is about proving you can sign in. XChaCha20-Poly1305 is about sealing the saved logins. Argon2id is about stretching the password into protection. Different doors, different jobs.
Stax Pass uses these together so “privacy-first” is a list of parts, not a vibe. The security guide is the map.
Is this worth paying for?
You cannot see a protocol. You can choose companies that publish which protocol they use. That is part of what a paid manager is for: engineering you will never watch, plus the honesty to name it. Stax Pass is a dollar-scale monthly cost after a free trial, not a mystery subscription.
Take this with you
- OPAQUE is a sign-in design, not a vault feature you click.
- It aims to prove the password without a reusable server copy.
- It does not forgive a weak main password or a phishing page.
Common questions
Does OPAQUE mean nobody can ever steal my password?
No. It means the service is designed not to hold it like a normal reusable secret. You can still type it in the wrong place.
Is this the same as two-factor authentication?
No. Two-factor is a second proof, like a phone prompt. Use both. See passwords and 2FA.
Why should I care about an RFC number?
Because a public spec can be reviewed by people who do not work for us. Secret recipes cannot.