Fruit is not a key, and that is fine
People need passwords they can remember or write once. Encryption needs long, well-shaped secret material. Those two things are different. Derivation is the bridge. It takes the human secret, mixes in extra data so two users with the same password do not get the same result, and produces key material of the right size.
Without that bridge, software is tempted to misuse the password directly, or to store a fast fingerprint that cheap hardware can try in bulk. The blender image holds: you want a process that is easy enough on one real device, and painful to run a warehouse of times.
The problem this solves in a password manager
A password manager stands or falls on one human password plus recovery material. Attackers who obtain protected data will try to guess that password. If derivation is fast and tiny, guessing is a hardware discount. If derivation is slow and memory-hard, guessing has a real bill.
Derivation also stops the password from having to be the encryption key in its raw form. That matters for length, format, and for keeping roles separate. The password is how a person starts the process. The derived material is what later locks and unlocks records.
What Stax Pass uses for the blender
Stax Pass uses Argon2id, a password-based key-derivation function that turns your password into cryptographic protection while requiring meaningful memory for every guess. That is the blender with the big pitcher. You feel a brief pause on a normal phone. A guessing factory feels a tax on every try.
Once keys exist, records are encrypted on the device before sync with XChaCha20-Poly1305, a method that keeps contents private and helps detect changes. For recipient-bound sharing, HKDF-SHA-256, a key-derivation method that uses the SHA-256 hash function, helps turn shared secret material into separate keys for specific jobs inside HPKE, a standard way to lock data to one recipient. Different derivation tools, different jobs. Password guessing cost is Argon2id's job: making each try expensive.
What you still have to do
Pick a long unique password for Stax Pass. Derivation adds cost. It does not invent secrecy that was never there. “Fluffy123” through a strong blender is still Fluffy with extra work. Do not reuse the manager password on other sites. Do not share it in chat.
Store the recovery phrase offline. Derivation does not recover a forgotten password for you. The phrase is the spare fruit, not a support reset. Read the security guide so you know which human secret starts the blender if the daily one is gone.
Honest limits
Expensive derivation slows guessing at stored data. It does not stop you from typing the password into a fake page. It does not stop someone who watches an unlocked screen. It does not help if the recovery phrase is photographed and stolen. The blender protects a secret that stays secret.
It also cannot make a reused password unique across the internet. If the same word opens Stax Pass and an old forum, a leak of the forum is still a clue. Derivation is one layer in a security model, not a substitute for unique passwords and a pause before unexpected links. Treat the blender as help, not as a pardon for a password you already reused.
Is this worth paying for?
A spreadsheet does not add this cost. It just sits there, ready to copy. Stax Pass spends real work turning your password into protection, then encrypts records on the device before they sync. Family plans start at $0.99 a month, and the 45-day trial needs no credit card. You pay for a blender that is meant to be expensive for attackers—not for a promise that no one will ever try.
Take this with you
- Key derivation turns a human password into cryptographic material and can make each guess costly.
- Stax Pass uses Argon2id, a memory-hard password function, for that derivation; that is not the same job as encrypting the saved records.
- A strong derivation function cannot fix a reused password, a phishing page, or a stolen recovery phrase.
Common questions
Why does unlocking take a moment on my phone?
A short pause can be the derivation cost doing its job. Stax Pass uses Argon2id, a memory-hard function, so each guess needs work and memory. One unlock on your device should feel ordinary. A million guesses on stolen data should not.
Is a fast hash such as SHA-256 enough for passwords?
A fast hash is the wrong tool by itself for a human password, because cheap hardware can try huge numbers of guesses. Stax Pass uses Argon2id, a memory-hard function, for password-based protection. HKDF-SHA-256, a key-derivation method that uses SHA-256, appears in a different place: deriving keys inside HPKE, a recipient-bound wrapping standard, not as the password blender.
Does derivation mean Stax Pass can recover my password?
No. A one-way recipe is not meant to be reversed into the original password. If you forget the password, you use the recovery phrase. If both are gone and no unlocked device remains, the encrypted records cannot be decrypted.