A recipe other cooks can taste
If a bakery claimed its bread was safe because the recipe was secret, you would not know whether the oven was hot enough. Public recipes can be copied, burned, improved, and argued about. That argument is useful. Independent cooks find the mistakes a single kitchen might miss.
Cryptography works the same way. The hard part is rarely inventing a brand-new lock. The hard part is getting the details right: how keys are made, how errors are handled, what happens when data is damaged, and how a design can change later. Public standards exist so those details can be written down and poked by people who do not work for the company selling the product.
The problem this solves in a password manager
A password manager holds the keys to email, banks, school portals, and the notes that sit next to those logins. You cannot reasonably audit that math yourself. You need a way to tell a studied design from a homemade one.
Named standards give you that handle. They do not make a product perfect. They give experts a shared language and a shared test. They also give you something to read when a company says “encrypted” and stops there. Encryption of what, with what, where, and with whose keys? A standard has answers. A slogan does not.
What Stax Pass names on purpose
Stax Pass encrypts saved records on your device before they sync, using XChaCha20-Poly1305, a method that keeps contents private and helps detect unwanted changes. Password-based protection uses Argon2id, a memory-hard function that turns a password into cryptographic material while making bulk guessing expensive.
Sign-in uses OPAQUE (RFC 9807), a password-authenticated key exchange that proves you know your password without making that password a reusable server-side secret. When something is protected for a specific recipient, Stax Pass uses HPKE, a standard way to lock data to one public key, with X25519, a public-key operation for shared secret material, and HKDF-SHA-256, a method that derives separate keys for separate jobs. Those names belong on the security guide so you can look them up.
How to read a security page without a degree
You do not need to perform the math. Look for four ordinary questions. What is encrypted? When does that happen—before upload, or only in transit? Who holds the keys, including during recovery? How does sign-in work, and is your password stored in a form the service can reuse?
If a page answers those questions with specific tools, you have something real to compare. If it answers with adjectives, keep looking. “Special sauce” is not a security model. Neither is a promise that nothing can ever go wrong. Honest products name the recipe and the leftover risk.
Honest limits
A good standard can still be used badly. A named algorithm does not stop you from typing a password into a fake page. It does not protect a recovery phrase saved in email. It does not lock a phone you already unlocked and handed over. Standards improve the locks. They do not replace judgment.
Standards also change. Researchers find problems. Better methods appear. That is a reason to prefer products that can evolve, not a reason to ignore today's choices. The useful habit is simple: pick tools that explain themselves, then protect the password and recovery phrase that those tools cannot replace.
Is this worth paying for?
You are not paying for mystery. You are paying for a password manager that is willing to say what it uses. Stax Pass names its on-device encryption, password-derived protection, OPAQUE—a sign-in handshake that proves you know the password without leaving a reusable copy—and recipient-bound sharing, then keeps recovery with you instead of a company spare key. Family plans start at $0.99 a month, with a 45-day free trial and no credit card. A small price is easier to judge when the ingredients are on the label.
Take this with you
- Public standards can be studied outside one company, which is stronger than a secret homemade lock.
- Stax Pass names its record lock, memory-hard password function, private sign-in protocol, and recipient-bound wrapping so those choices can be checked.
- A named standard still cannot stop phishing or a stolen recovery phrase, so your habits remain part of the design.
Common questions
If the standard is public, can attackers use it too?
Yes, and that is expected. Security should come from secret keys, not from hiding the recipe. A public method that needs the key is the usual goal. A secret method that nobody can review is harder to trust.
Do I need to understand RFC 9807 to use Stax Pass?
No. RFC 9807 is the public write-up of OPAQUE, a password-authenticated key exchange that proves you know your password without making it a reusable server secret. You only need that plain-language point. The document exists so experts can inspect the claim.
Are homemade algorithms always worse?
They are a warning sign. Inventing a new lock is easy to get almost right and hard to get entirely right. Established standards receive more review. Prefer products that explain a known design over products that boast about a private one.