# Identity and unlock

> Palladin documentation · 1.0 · EN · 2026-10-25


## Signing in and unlocking a vault

Signing in establishes who you are. Unlocking a vault gives the app the keys to read it. These are separate steps: a login session alone cannot decrypt your data.

<figure class="doc-diagram"><ol><li>Sign in → session</li><li>Authorization → ciphertext</li><li>Unlock → keys</li><li>Local read</li></ol><figcaption>Reading requires both authorization to retrieve data and the ability to decrypt it.</figcaption></figure>

## Recovery

Your recovery key restores access when you lose your master password. The client opens the protected material locally, lets you set a new password, and creates a new recovery key. Store the new key in a safe place.

Restoring a login session alone does not decrypt a vault. Palladin cannot recover data without the material needed to decrypt it.

## Identity changes

Changing a password can preserve an existing private key and protect it with the new password. Replacing the keypair is a different operation: access to shared vaults must be prepared again.

## Client boundary

Your browser downloads the app code from a server. Someone who replaces that code may try to capture data when you unlock. Vault encryption therefore does not replace application and device security.