On your device
You save a password or note
Example login••••••••••••Readable only after you unlock
A visual security guide
See what happens to your passwords.
Stax Pass is a password manager built so your passwords and private notes are protected on your device before records are synced. This page shows the path, the limits, and what you need to keep safe.
No hype. No “trust us” language. Just how the protection is designed to work.
How your passwords travel
Readable for you. Protected before they travel.
When you save a password or private note, the app is designed to protect it locally first. The service can then carry and sync the protected record without needing the readable content inside.
Stax Pass service
It carries a protected record
protected password record7V9x · 2Qa! · mL4#Not a readable password or note
Your other approved device
You unlock it locally
Same saved password••••••••••••Only after your local unlock
Readable only on your unlocked deviceProtected record carried for syncAccount and device information still helps the service operate
Two different kinds of security
Your account entrance is not your password-manager key.
It is important not to mix these up. Email and device checks help stop strangers from entering your account. Your password and recovery phrase are what unlock your saved passwords.
✉
Account entrance
Email verification and device approval
These checks help confirm an email inbox and approve a new device. A six-digit email code is short-lived and should stay private.
It cannot decrypt your saved passwords.⌘
Password-manager unlock
Your password or recovery phrase
These secrets are used locally to unlock protected key material. They are not interchangeable with an email code or a support request.
These are the paths to your saved passwords.How the keys fit together
One unlock opens the next layer—not everything at once.
This is a simplified map of the local key structure. Select a layer to see its job.
Private sign-in proof
How can the service verify you without keeping your password?
Stax Pass uses a password and recovery authentication system called OPAQUE. In plain English: your app and the service perform a protected proof. The service can confirm the proof without receiving the raw password or recovery words as a reusable secret.
Your device
Your password
stays here
stays here
protected proof
Stax Pass service
Proof checks out
Approved
Approved
The service sees the protected authentication exchange—not a customer-support list of raw passwords or recovery phrases.
Recovery, without fine print
Know your path back in before you need it.
Your 12- or 24-word phrase is an alternate way to unlock your User Root Key. It is not a customer-service reset code. Choose a situation below.
You still have your recovery phrase
You have a recovery path.
Use the recovery phrase on a new device to prove access and set a new password. Afterward, store the password and phrase separately and securely.
Support does not need to see the phrase to help the recovery flow work.!
The non-negotiable part: if both your password and recovery phrase are gone, and you no longer have an unlocked device, your saved passwords and private notes cannot be decrypted. Stax Pass cannot rebuild the key, reset access, or use an administrator backdoor—because we do not keep one.
Technical reference
The names behind the protection.
These are public, reviewed cryptographic tools—not secret algorithms. The important part is what each one does for you.
The local crypto core is designed to use secure operating-system randomness and fail closed: damaged or unauthenticated protected data should be rejected, not quietly accepted.
Your part matters
Protect your password and recovery phrase.
Use a strong, unique password. Keep your recovery phrase private and offline. Never share a verification code, password, or recovery phrase with anyone who contacts you.