■ Docs
The vault
How your game logins are stored, and why Thrall cannot read them.
The vault holds your game usernames, passwords and bank pins. It exists only in your browser. Thrall’s servers never receive it, encrypted or otherwise.
What is stored, and where
Two things are saved in your browser’s storage for this site, separately for each Thrall account:
| What | Contains | Encrypted |
|---|---|---|
| The roster | The name and task of each tile | No. It holds nothing secret |
| The vault | Usernames, passwords, bank pins | Yes |
Nothing else about your game accounts is stored anywhere.
How it is encrypted
- Cipher: AES-256-GCM, with a fresh random nonce every time the vault is saved.
- Key: made from your passphrase with PBKDF2-SHA256, 600,000 rounds, and a random 16-byte salt.
- Where the key lives: in the page’s memory only. It is never written to storage.
Reloading the page forgets the key, so the vault is locked again. Lock forgets it at once.
Locked and unlocked
While the vault is locked you can see the wall and the roster, but not usernames or passwords, and you cannot start a client.
Entering your passphrase unlocks it for that page. Starting a client, showing a password, and adding, editing or removing an account all need it unlocked. Thrall asks when it is needed.
If you forget the passphrase
The logins cannot be recovered. Thrall never had the passphrase or the key, so there is nothing to reset.
Delete the vault from the Accounts page and create a new one. Your game accounts themselves are not affected.
Moving to another browser
- On the Accounts page, choose Export. One file is saved. It is still encrypted.
- On the other device, sign in to Thrall, open Accounts and choose Import.
- Unlock it with the same passphrase.
Importing replaces whatever vault that browser had.
Changing the passphrase
Choose Change next to Passphrase. Everything is decrypted and re-encrypted under the new one, on your device.
Clearing browser data
The vault is in the browser’s site storage. Clearing site data, using a private window, or uninstalling the browser removes it. Export it first if you want to keep it.
What Thrall’s servers do hold
Your Thrall account: email address, display name, a hash of your Thrall password, your plan, and a record of sign-ins. See the privacy policy.