Forget the name for a minute
Imagine a sealed envelope. The paper is thick enough that nobody can read the letter by holding it up to the light. There is also a tamper strip. If the strip is broken, you do not trust the letter even if it still looks like your handwriting.
XChaCha20 is the thick paper—the part that turns your password into unreadable ciphertext. Poly1305 is the tamper strip—a small extra value that should only match if the contents are intact. Together they are called authenticated encryption: privacy plus a honesty check.
Why a password manager needs both
Hiding a password is not enough if a stored copy could be quietly edited. You want the record you unlock to be the record you saved. A lock that only hides, without checking, is a curtain. A lock that hides and checks is a seal.
This still happens on your device in Stax Pass, before a record syncs. The service is designed to store the sealed envelope, not the letter. That is what encryption before sync means.
What this does not do
It does not stop you from typing a password into a fake website. It does not stop someone who already unlocked your phone. It does not let Stax Pass support peek “just this once.” There is no spare key behind the counter.
Your job stays human: a unique main password, a recovery phrase on paper, and a pause before urgent links. The algorithm’s job is the envelope.
Why the long name exists
Engineers use specific names so other engineers can test the same design. ChaCha20 and Poly1305 are public. The “X” is a variant that is safer to use many times with different records. You do not need to pick those settings. You should be glad a product names them instead of saying “military grade.”
When a company will not say what lock it uses, you are being asked to trust a mood. When it names XChaCha20-Poly1305, you can read the security guide and compare.
Is this worth paying for?
You are not paying for a poetic name. You are paying for a vault that seals each record on the device so the copy in transit is not a readable list. Browser notes are free and readable. Stax Pass starts with a 45-day trial. The monthly cost is the difference between a list and a sealed envelope.
Take this with you
- XChaCha20 hides. Poly1305 checks. Together they seal a record.
- In Stax Pass that seal is applied on your device before sync.
- A sealed record still needs you not to hand the letter to a stranger.
Common questions
Do I have to configure this?
No. It is how saved records are protected. You choose a main password and keep a recovery phrase.
Is this the same as “the password is hashed”?
No. Hashing is a one-way mix used for some checks. This is encryption of a record you will need to open again. See hashing versus encryption.
Could a future lock replace this?
Serious products plan for that. Naming today’s lock is how you know what is in use now. See crypto agility.