Master password

Your master password is the one password you need to remember. It unlocks your vault, and all your encryption keys are derived from it.

Only you know your master password. Citadel never stores or sees it, so no one else can open your vault.

How Citadel uses it

• It's never stored, not on your devices and not in the cloud.
• It's never sent to our servers, not even when you sign in. Citadel uses the Secure Remote Password (SRP) protocol instead.
• It's turned into keys on your device with PBKDF2-HMAC-SHA512 and 650,000 iterations. How it works
• Spaces at the beginning or end are ignored, so a stray space won't lock you out.

Choosing a good master password

• Make it long. A passphrase of four or more random words is easier to remember and harder to guess than a short password full of symbols.
• Make it unique. Never use your master password for any other account.
• Keep it impersonal. Avoid names, birthdays, addresses and anything else someone could find out about you.

Four or more random, unrelated words make a master password that's both strong and easy to remember.

Keeping it safe

Write your master password down and keep it somewhere safe offline, such as with your important papers at home. Don't store it in an unencrypted note, an email or a photo.