Skip to content
Palladin.ioDocumentation
PL
Docs/Security whitepaper

Identity and unlock

Signing in to the service and opening keys are separate operations.

1.025.10.2026Markdown ↗PDF ↓Read in full ↗

Signing in and unlocking a vault

Signing in establishes who you are. Unlocking a vault gives the app the keys to read it. These are separate steps: a login session alone cannot decrypt your data.

  1. Sign in → session
  2. Authorization → ciphertext
  3. Unlock → keys
  4. Local read
Reading requires both authorization to retrieve data and the ability to decrypt it.

Recovery

Your recovery key restores access when you lose your master password. The client opens the protected material locally, lets you set a new password, and creates a new recovery key. Store the new key in a safe place.

Restoring a login session alone does not decrypt a vault. Palladin cannot recover data without the material needed to decrypt it.

Identity changes

Changing a password can preserve an existing private key and protect it with the new password. Replacing the keypair is a different operation: access to shared vaults must be prepared again.

Client boundary

Your browser downloads the app code from a server. Someone who replaces that code may try to capture data when you unlock. Vault encryption therefore does not replace application and device security.