How it works
1. Your key
The app draws 95 bits from a cryptographically secure random number generator and renders them as 20 readable characters. The alphabet is Crockford Base32: no I, L, O or U, because they get confused with 1 and 0. The last character is a check character. It catches any single mistyped character, and any two swapped characters, 100% of the time.
2. The master secret
Your key goes through Argon2id (64 MiB of memory, 3 passes). Argon2id is today’s standard for password derivation: being memory-hard makes it hard to accelerate with special hardware. The result is a 32-byte master secret, and it is never written anywhere but memory.
3. The site password
The master secret, the site name, the username and the counter go through HMAC-SHA256, and the result is expanded into a byte stream with HKDF. Characters are chosen from that stream by rejection sampling. That is, we do not use the "divide the byte by the alphabet size and take the remainder" shortcut, because that shortcut makes some characters more likely than others.
4. Your world
Your planet comes from SHA-256 of your key’s text: its colour, its surface, its rings, its moons. That calculation is fast, because it has to re-run on every keystroke as you type. The preview you see is your real world, not an imitation. Being fast costs no security: guessing the 95 bits of your key would take millions of years even at a hundred trillion attempts per second.
5. Your vault
The site list kept on your device is encrypted with XChaCha20-Poly1305, under a key derived from the master secret with HKDF. There are no passwords inside the vault, only which site you generated with which settings.
Why these choices?
We invented none of them. Argon2id is RFC 9106, HMAC-SHA256 is FIPS 180-4, HKDF is RFC 5869, and XChaCha20-Poly1305 is a widely reviewed construction. Writing your own encryption algorithm is the worst thing you can do in security.
You can verify it
The whole algorithm is written down in SPEC.md and ships with 47 test vectors. Both the web version and the Android version have to pass every one of them, which is how we know the two platforms produce bit-for-bit identical passwords from the same key.