Master Password —
one key that never leaves your device

Your Pivlu account password (used to log in to accounts.pivlu.com) and your vault master password are completely separate credentials. Compromising your account password does not expose your vault. Someone who resets your account password still cannot open your vault.

Your master password is processed through PBKDF2-SHA256 (Password-Based Key Derivation Function 2) with a unique 256-bit random salt and 600,000 iterations. PBKDF2 is designed to be slow — intentionally. Each brute-force guess takes meaningful time even on dedicated hardware.

PBKDF2 produces 512 bits of output. The first 256 bits become your encryption key — used locally in the browser to decrypt vault data, never transmitted. The second 256 bits become your auth key — hashed with SHA-256 and sent to the server only for identity verification.

There is no "forgot master password" flow. We cannot reset your master password because we don't store it, can't derive it, and have no mechanism to substitute it. If you lose your master password, your encrypted vault data becomes permanently inaccessible. This is the security guarantee, not a bug.

On modern hardware, 600,000 PBKDF2 iterations takes about 300ms in a browser. For you, unlocking your vault is barely noticeable. For an attacker testing millions of guesses per second, each guess costs the same 300ms — making a brute-force attack orders of magnitude slower than against a regular hashed password.

Each account gets a unique cryptographically random 256-bit salt generated at vault setup. The salt is combined with your master password before derivation. This means two users with the same master password produce completely different encryption keys — rainbow tables and precomputed attacks are useless.

OWASP recommends at least 600,000 iterations of PBKDF2-SHA256 for password hashing (2023 guidelines). Vault meets this benchmark. The iteration count is a parameter we can increase in future updates as hardware improves — your master password re-derives the next time you unlock.