Your encryption password and recovery key
Maestra uses an encryption password and a recovery key as two ways to unwrap the same data key.
Encryption password
Section titled “Encryption password”When an installation needs to unlock, it sends the encryption password over an authenticated TLS request so the account can be verified and the wrapped key material returned. On-device code derives the master key from that password and unwraps the data key locally. Maestra does not store the plaintext encryption password and never receives the unwrapped data key.
The unwrapped data key remains device-held. Maestra stores only the wrapped forms and salts required for password and recovery unlock.
Recovery key
Section titled “Recovery key”The recovery key is a random alternate unlock secret. Spacing and letter case are normalized when it is entered during reset. Keep a copy in a password manager or another secure place.
An encrypted backup of the recovery key is stored with the account. On an unlocked installation, Settings → Recovery Key asks for the encryption password before fetching and decrypting that backup locally. Maestra cannot read the recovery key.