From cbbb804bfcd6a669d16a053975402d0a782017a8 Mon Sep 17 00:00:00 2001 From: Nils Pukropp Date: Tue, 20 Oct 2026 11:45:32 +0200 Subject: [PATCH] docs: what a vault password change does not take back MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit :passwd re-wraps the same master key, so a database copy from before the change — a pre-migration snapshot, a Proton Drive revision — still opens every sealed file with the old password. Say so, until a real rekey exists. --- README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/README.md b/README.md index 8ad2bf6..d009bdb 100644 --- a/README.md +++ b/README.md @@ -307,6 +307,13 @@ it back out. `:unlock` and `:lock` open and close it, `:passwd` changes the password. A sealed file carries a lock in the list, and the bar says `vault open` while it is. +`:passwd` wraps the same key under the new password, so no file has to be +rewritten — and so it does not take back what the old password opens. A copy +of `diary.db` from before the change (a `diary.db.pre-*` snapshot, a backup in +Proton Drive) still unwraps the key with the old password, and that key still +opens every sealed file. Change the password because you want a new one, not +to shut out someone who has the old one and an old copy. + `:encrypt` on a folder or space seals it for good, not just once: every file in it now, and every file that lands in it later. An upload, an import, an SFTP write and a file or folder moved in are all sealed on the way in. While the