diff --git a/Cargo.lock b/Cargo.lock
index 4a4ca40..80c555a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6089,6 +6089,7 @@ version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
 dependencies = [
+ "serde",
  "zeroize_derive",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index bfdce48..5403e06 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ chrono-tz = "0.10"
 # opened a chunk at a time; Argon2id between the password and the key.
 aes-gcm = { version = "0.10", features = ["stream"] }
 argon2 = "0.5"
-zeroize = "1"
+zeroize = { version = "1", features = ["serde"] }
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
 
 proton-drive-rs = "0.9.2"
diff --git a/README.md b/README.md
index 6d66b38..5d53ab1 100644
--- a/README.md
+++ b/README.md
@@ -257,10 +257,14 @@ narl-workspace proton-login                       # or, in Docker:
 docker compose exec -it workspace narl-workspace proton-login
 ```
 
-That stores a session — tokens, the mailbox password needed to rebuild the key
-chain, and the account key salts — as a `0600` file next to the database. It
-sits on the same volume as the workspace it protects, and it is enough to read the
-account, so the volume is the thing to keep private. Built with
+That checks the password against the account's keys and stores a session —
+the tokens, and the key passphrases derived from the password at login — as a
+`0600` file next to the database. The password itself is never stored: the
+passphrases unlock the keys but cannot log in, change the password or turn 2FA
+off. They are still enough to read the account, and the file sits on the same
+volume as the workspace it protects, so the volume is the thing to keep private.
+A session stored by an older build, which kept the password, is rewritten
+without it on the next start; no new login is needed. Built with
 `--features keyring` on a host that has a Secret Service, the session goes to
 the OS keyring instead and the file is only a fallback; the container has no
 session bus, so there it is always the file.
diff --git a/src/backup/proton.rs b/src/backup/proton.rs
index 9700a46..a0ccca8 100644
--- a/src/backup/proton.rs
+++ b/src/backup/proton.rs
@@ -2,7 +2,9 @@
 
 use anyhow::{anyhow, Context, Result};
 use proton_drive_rs::{Device, DeviceType, ProtonDriveClient};
+use proton_sdk::account::AccountClient;
 use proton_sdk::config::ProtonClientConfiguration;
+use proton_sdk::error::ProtonError;
 use proton_sdk::session::ProtonApiSession;
 
 use super::session::{SessionStore, StoredSession};
@@ -60,22 +62,24 @@ pub async fn login(
             .context("Proton rejected the second-factor code")?;
     }
 
-    // Salts are fetched here and only here: this access token still carries the
-    // `locked` scope, and no refreshed one ever will.
+    // The passphrases are derived here and only here: this access token still
+    // carries the `locked` scope the key salts need, and no refreshed one ever
+    // will. Unlocking checks them against the account's keys before anything
+    // is stored, so a wrong mailbox password fails now and not at the first
+    // backup.
     let client = ProtonDriveClient::new(&session, password.as_bytes().to_vec());
-    let key_salts = client
-        .account()
-        .key_salts()
+    let account = client.account();
+    let key_passphrases = account
+        .key_passphrases()
         .await
-        .context("could not read the account key salts")?;
+        .context("could not derive the account key passphrases")?;
+    account.unlock().await.map_err(|e| match e {
+        ProtonError::KeysLocked => anyhow!("that password does not unlock the account's keys"),
+        e => anyhow::Error::from(e).context("could not unlock the account's keys"),
+    })?;
 
     let tokens = session.current_tokens().await;
-    store.save(&StoredSession::from_session(
-        &session,
-        tokens,
-        password,
-        key_salts,
-    ))?;
+    store.save(&StoredSession::from_session(&session, tokens, key_passphrases))?;
     Ok(())
 }
 
@@ -83,17 +87,15 @@ pub async fn login(
 /// been stored yet — that is the ordinary "backups are not set up" state, not
 /// an error.
 pub async fn resume(store: &SessionStore) -> Result<Option<ProtonDriveClient>> {
-    let Some(stored) = store.load()? else {
+    let Some(mut stored) = store.load()? else {
         return Ok(None);
     };
 
     let session = ProtonApiSession::resume(client_config(), stored.resume_parameters())
         .context("the stored Proton session could not be resumed")?;
 
-    if stored.key_salts.is_empty() {
-        return Err(anyhow!(
-            "the stored Proton session has no key salts — run `narl-workspace proton-login` again"
-        ));
+    if stored.key_passphrases.is_empty() {
+        stored = upgrade(store, &session, stored).await?;
     }
 
     // Every 401 refresh mints a new refresh token and invalidates the old one,
@@ -111,18 +113,50 @@ pub async fn resume(store: &SessionStore) -> Result<Option<ProtonDriveClient>> {
         }
     });
 
-    let client = ProtonDriveClient::with_key_salts(
-        &session,
-        stored.mailbox_password.clone().into_bytes(),
-        stored.key_salts.clone(),
-    )
-    // A workspace is mostly small files; one atomic request beats the
-    // draft/block/commit dance for anything that fits in a single block.
-    .with_small_file_upload(true);
+    let client = ProtonDriveClient::with_key_passphrases(&session, stored.key_passphrases)
+        // A workspace is mostly small files; one atomic request beats the
+        // draft/block/commit dance for anything that fits in a single block.
+        .with_small_file_upload(true);
 
     Ok(Some(client))
 }
 
+/// Rewrite a session stored before the passphrases were, which kept the
+/// mailbox password and the key salts instead. The salts are already known, so
+/// the passphrases derive locally, with no request and no new login, and the
+/// password is gone from the store once the new session is written.
+async fn upgrade(
+    store: &SessionStore,
+    session: &ProtonApiSession,
+    stored: StoredSession,
+) -> Result<StoredSession> {
+    let (Some(password), false) = (&stored.mailbox_password, stored.key_salts.is_empty()) else {
+        return Err(anyhow!(
+            "the stored Proton session has no key passphrases — run `narl-workspace proton-login` again"
+        ));
+    };
+
+    let account = AccountClient::with_key_salts(
+        session,
+        password.clone().into_bytes(),
+        stored.key_salts.clone(),
+    );
+    let key_passphrases = account
+        .key_passphrases()
+        .await
+        .context("could not derive key passphrases from the stored session")?;
+
+    let upgraded = StoredSession {
+        key_passphrases,
+        mailbox_password: None,
+        key_salts: Vec::new(),
+        ..stored
+    };
+    store.save(&upgraded)?;
+    tracing::info!("the stored Proton session now keeps key passphrases instead of the password");
+    Ok(upgraded)
+}
+
 /// The device this server owns, registered on first use.
 ///
 /// A device is a sync root with its own share, which is what makes the workspace
@@ -152,7 +186,53 @@ pub async fn ensure_device(client: &ProtonDriveClient, name: &str) -> Result<Dev
 
 #[cfg(test)]
 mod tests {
-    use super::app_version;
+    use super::*;
+
+    /// No request leaves for this: resuming only builds the HTTP client, and
+    /// with the salts already stored the passphrases derive locally.
+    #[tokio::test]
+    async fn an_old_session_trades_its_password_for_passphrases() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("proton-session.json");
+        std::fs::write(
+            &path,
+            r#"{"session_id":"s","username":"u","user_id":"i","access_token":"a",
+               "refresh_token":"r","scopes":[],"password_mode":1,
+               "mailbox_password":"hunter2hunter2",
+               "key_salts":[{"ID":"key-1","KeySalt":"c2FsdHNhbHRzYWx0c2FsdA=="}]}"#,
+        )
+        .unwrap();
+        let store = SessionStore::new(&path);
+        let stored = store.load().unwrap().unwrap();
+        let session = ProtonApiSession::resume(client_config(), stored.resume_parameters()).unwrap();
+
+        let upgraded = upgrade(&store, &session, stored).await.unwrap();
+        assert_eq!(upgraded.key_passphrases.len(), 1);
+        assert!(upgraded.key_passphrases.get("key-1").is_some());
+
+        let json = std::fs::read_to_string(&path).unwrap();
+        assert!(!json.contains("hunter2"), "{json}");
+        let reloaded = store.load().unwrap().unwrap();
+        assert!(reloaded.key_passphrases == upgraded.key_passphrases);
+    }
+
+    #[tokio::test]
+    async fn a_session_with_nothing_to_unlock_with_asks_for_a_login() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("proton-session.json");
+        std::fs::write(
+            &path,
+            r#"{"session_id":"s","username":"u","user_id":"i","access_token":"a",
+               "refresh_token":"r","scopes":[],"password_mode":1}"#,
+        )
+        .unwrap();
+        let store = SessionStore::new(&path);
+        let stored = store.load().unwrap().unwrap();
+        let session = ProtonApiSession::resume(client_config(), stored.resume_parameters()).unwrap();
+
+        let error = upgrade(&store, &session, stored).await.err().unwrap();
+        assert!(error.to_string().contains("proton-login"), "{error}");
+    }
 
     #[test]
     fn identifies_itself_the_way_proton_requires() {
diff --git a/src/backup/session.rs b/src/backup/session.rs
index 85e4506..0cbb8c7 100644
--- a/src/backup/session.rs
+++ b/src/backup/session.rs
@@ -1,16 +1,22 @@
 //! The stored Proton session: everything needed to come back up unattended.
 //!
 //! A login is worth persisting whole, because none of it can be re-derived
-//! without a human: the tokens (the session itself), the mailbox password
-//! (which rebuilds the key chain on every start — the SDK needs it in memory to
-//! decrypt anything), and the account's key salts.
+//! without a human: the tokens (the session itself) and the key passphrases
+//! (which rebuild the key chain on every start — the SDK needs them in memory
+//! to decrypt anything).
 //!
-//! The salts matter more than they look. `core/v4/keys/salts` requires the
-//! `locked` scope, and only the access token minted by a *password* login
-//! carries it; once that token has been rotated through `auth/v4/refresh` — as
-//! it is on every restart after the first — the endpoint answers 403 and the
-//! key chain can no longer be unlocked. So the salts are captured at login and
-//! handed back on resume, exactly as the desktop client does it.
+//! The passphrases are what the password is for: each is
+//! `bcrypt(mailbox password, key salt)` and unlocks one account key. Keeping
+//! them instead of the password means the store never holds the password
+//! itself, which on a single-password account is the login password. They
+//! read the account all the same, so they are no less secret — but they cannot
+//! log in, change the password or turn 2FA off.
+//!
+//! They are derived at login and only then. Deriving needs the key salts, and
+//! `core/v4/keys/salts` requires the `locked` scope, which only the access
+//! token minted by a *password* login carries; once that token has been rotated
+//! through `auth/v4/refresh` — as it is on every restart after the first — the
+//! endpoint answers 403.
 //!
 //! Refresh tokens are single-use: a rotation that is not written back leaves a
 //! dead token on disk and the next resume fails. Hence the refresh hook in
@@ -20,6 +26,7 @@ use std::path::{Path, PathBuf};
 
 use anyhow::{Context, Result};
 use proton_drive_rs::KeySalt;
+use proton_sdk::account::KeyPassphrases;
 use proton_sdk::session::{PasswordMode, ProtonApiSession, ResumeParameters};
 use serde::{Deserialize, Serialize};
 
@@ -33,12 +40,16 @@ pub struct StoredSession {
     pub scopes: Vec<String>,
     /// `1` = single password, `2` = dual (Proton's wire values).
     pub password_mode: u8,
-    /// Mailbox (data) password. `ProtonDriveClient` derives the key chain from
-    /// it on every construction, so a backup that runs unattended has to hold
-    /// it — there is no token-only mode.
-    pub mailbox_password: String,
-    /// Captured at login, because a refreshed token may no longer fetch them.
-    #[serde(default)]
+    /// Key id → the passphrase that unlocks it, derived at login. Empty only
+    /// in a session written before they were, which still has the two fields
+    /// below.
+    #[serde(default, with = "passphrases")]
+    pub key_passphrases: KeyPassphrases,
+    /// What a session stored before the passphrases kept instead of them.
+    /// Read once, to derive the passphrases, and never written again.
+    #[serde(default, skip_serializing)]
+    pub mailbox_password: Option<String>,
+    #[serde(default, skip_serializing)]
     pub key_salts: Vec<KeySalt>,
 }
 
@@ -46,8 +57,7 @@ impl StoredSession {
     pub fn from_session(
         session: &ProtonApiSession,
         tokens: proton_sdk::http::Tokens,
-        mailbox_password: &str,
-        key_salts: Vec<KeySalt>,
+        key_passphrases: KeyPassphrases,
     ) -> Self {
         Self {
             session_id: session.session_id().as_str().to_owned(),
@@ -60,8 +70,9 @@ impl StoredSession {
                 PasswordMode::Single => 1,
                 PasswordMode::Dual => 2,
             },
-            mailbox_password: mailbox_password.to_owned(),
-            key_salts,
+            key_passphrases,
+            mailbox_password: None,
+            key_salts: Vec::new(),
         }
     }
 
@@ -82,6 +93,31 @@ impl StoredSession {
     }
 }
 
+/// Passphrases are bytes; the session file is JSON. Each one is kept as
+/// base64 under its key id.
+mod passphrases {
+    use std::collections::BTreeMap;
+
+    use base64::{engine::general_purpose::STANDARD, Engine};
+    use proton_sdk::account::KeyPassphrases;
+    use serde::{de::Error, Deserialize, Deserializer, Serializer};
+    use zeroize::Zeroizing;
+
+    pub fn serialize<S: Serializer>(value: &KeyPassphrases, out: S) -> Result<S::Ok, S::Error> {
+        out.collect_map(value.iter().map(|(id, passphrase)| (id, STANDARD.encode(passphrase))))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(input: D) -> Result<KeyPassphrases, D::Error> {
+        let encoded = BTreeMap::<String, Zeroizing<String>>::deserialize(input)?;
+        let mut passphrases = KeyPassphrases::new();
+        for (id, passphrase) in encoded {
+            let bytes = STANDARD.decode(passphrase.as_bytes()).map_err(D::Error::custom)?;
+            passphrases.insert(id, bytes);
+        }
+        Ok(passphrases)
+    }
+}
+
 /// Where a session is kept.
 ///
 /// The OS keyring is the right home for this and is what the desktop client
@@ -202,3 +238,65 @@ fn keyring_clear() -> Result<()> {
         Ok(Err(e)) => Err(e.into()),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn stored(key_passphrases: KeyPassphrases) -> StoredSession {
+        StoredSession {
+            session_id: "session".into(),
+            username: "someone".into(),
+            user_id: "user".into(),
+            access_token: "access".into(),
+            refresh_token: "refresh".into(),
+            scopes: vec!["full".into()],
+            password_mode: 1,
+            key_passphrases,
+            mailbox_password: None,
+            key_salts: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn passphrases_survive_the_file_and_the_password_never_reaches_it() {
+        let dir = tempfile::tempdir().unwrap();
+        let store = SessionStore::new(dir.path().join("proton-session.json"));
+        let passphrases =
+            KeyPassphrases::from_iter([("key-1", b"one\0\xff".to_vec()), ("key-2", b"two".to_vec())]);
+
+        // Even a session that still holds the old fields in memory writes
+        // neither of them.
+        let mut session = stored(passphrases.clone());
+        session.mailbox_password = Some("hunter2hunter2".into());
+        store.save(&session).unwrap();
+
+        let json = std::fs::read_to_string(store.path()).unwrap();
+        assert!(!json.contains("hunter2"), "{json}");
+        assert!(!json.contains("mailbox_password"), "{json}");
+        assert!(!json.contains("key_salts"), "{json}");
+
+        let loaded = store.load().unwrap().unwrap();
+        assert!(loaded.key_passphrases == passphrases);
+        assert!(loaded.mailbox_password.is_none());
+    }
+
+    #[test]
+    fn a_session_from_before_the_passphrases_still_loads() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("proton-session.json");
+        std::fs::write(
+            &path,
+            r#"{"session_id":"s","username":"u","user_id":"i","access_token":"a",
+               "refresh_token":"r","scopes":[],"password_mode":1,
+               "mailbox_password":"hunter2hunter2",
+               "key_salts":[{"ID":"key-1","KeySalt":"c2FsdHNhbHRzYWx0c2FsdA=="}]}"#,
+        )
+        .unwrap();
+
+        let loaded = SessionStore::new(path).load().unwrap().unwrap();
+        assert!(loaded.key_passphrases.is_empty());
+        assert_eq!(loaded.mailbox_password.as_deref(), Some("hunter2hunter2"));
+        assert_eq!(loaded.key_salts.len(), 1);
+    }
+}