Does Private.Ki store my password?
No. Sign-in uses the OPAQUE protocol — our server holds a record it can check a password against, but never the password itself or a conventional hash.
No. Your password never reaches our server — not when you create your account, not when you sign in, not when you change it. This is not a promise about how we handle it; it is a property of the sign-in protocol. Private.Ki uses OPAQUE, a password-authenticated key exchange in which the password is used only on your device.
What the server holds instead
For each account the server stores an OPAQUE record. It is produced on your device when you register a password and lets the server take part in a sign-in without learning the password:
- It is not the password. There is no field, log or cache with your password in it, in any form.
- It is not a conventional hash (such as bcrypt or Argon2 of the password). With a hash, anyone who steals the database can run guesses through the same function offline until one matches. An OPAQUE record is bound to a per-account secret and cannot be checked against guesses in that way.
- It cannot be used to sign in. Possessing the record does not let anyone act as you.
If a copy of our user database leaked, an attacker would find OPAQUE records and would still have to talk to our live server for every single guess — which is exactly where proof-of-work and the other sign-in protections live.
What happens when you sign in
- Your device and our server run the OPAQUE exchange. Your device proves it knows the password; the server proves it holds the matching record. Neither side sends the password.
- If the exchange succeeds, the server issues your session tokens (bound to your device, so a stolen token is useless elsewhere).
- Separately, on password-only accounts your device derives a secret from the password and a per-account salt to open your encrypted private key. That derivation also happens on your device.
If anything in step 1 fails, the sign-in screen shows We couldn't log you in. Something you entered was incorrect, but we can't say what — the server itself does not know whether it was the username or the password, and it will not tell an attacker which usernames exist.
The protocol is described in more detail in What is OPAQUE?.
What this means for you
- We cannot remind you of your password. There is nothing to look up.
- We cannot reset it on request. Resetting is possible only when you prove ownership through a recovery email address — see Reset a forgotten password.
- Changing your password registers a fresh OPAQUE record; the old one is discarded. See Change your password.
- Your passphrase is never stored either. If you unlock with a passphrase, it protects your private key on your device and is never sent to us — see Your passphrase.
What our server sees
Cannot see
- Your password, at registration, sign-in or change
- A hash of your password
- Your passphrase or your unlocked private key
Can see
- One OPAQUE record per account, replaced whenever you change or reset your password
- The per-account salt used on password-only accounts to derive the key that opens your private key (the salt alone is useless without the password)
- When you signed in, and whether each attempt succeeded
Common questions
If you don't have my password, how can you check it?
That is what OPAQUE is for. The server's record and your password together complete a cryptographic exchange; a wrong password makes the exchange fail, and a right one makes it succeed, without the password ever being sent. See What is OPAQUE?.
Isn't a hash good enough?
A hash protects against someone reading passwords off the disk, but not against offline guessing once the database is copied. OPAQUE removes the offline-guessing route: every guess has to go through our live server, where it is slowed by proof-of-work and can be observed.
Does support see my password?
No. Support can see your username, whether two-factor is on, whether a recovery address is set, and sign-in problems such as rate limits — never a password, a passphrase or your mail.
Does OPAQUE encrypt my mail?
No. OPAQUE covers sign-in only. Your mail and chats are protected by end-to-end encryption with keys generated on your device — see How encryption works.