How Satchel keeps a secret.

One key, two ways in.

When you create a vault, Satchel makes a random 256-bit vault key. That key encrypts everything. Your master password and Touch ID never encrypt items themselves; each one only unlocks a copy of the vault key.

So changing your password, or turning Touch ID on, rewraps one small key and re-encrypts nothing. Your password is never stored, not even in the Keychain.

Each item sealed on its own.

Every item is a separate file with a short header and two sealed boxes. Search reads the first box; the second is opened only when you look at or copy a secret.

Both boxes use XChaCha20-Poly1305 from libsodium, with a fresh random 192-bit nonce each time an item is saved. The header is authenticated together with the boxes, so it can't be moved onto another item without the change being caught.

Nothing old comes back.

Next to the items sits a manifest: the list of every item and its version, with a counter that only goes up, signed with a key derived from your vault key. If a file disappears, is edited, or is swapped for an older one, the manifest no longer agrees.

When a sync host serves a vault older than the one your Mac last saw, from a restored backup or a host that misbehaves, Satchel stops and tells you. It never quietly brings back a password you changed.

What your sync host sees.

Two Macs can save at the same moment. Satchel writes only if the file is still the version it read, and before using a WebDAV or S3 server it checks that the server really refuses a stale write. A server that doesn't would let two Macs overwrite each other, so Satchel won't use it.

In the browser.

• A page gets only logins saved for its own site, matched by registrable domain with the Public Suffix List.
• Only the page you see is filled, never a frame embedded inside it.
• Nothing is filled without your click or shortcut, and forms are never submitted.
• When you copy a password from the toolbar panel, Satchel copies it. The secret never passes through the extension.
• The Mac app checks the site again itself before it hands over a login. The extension's word is not enough.

Around your Mac.

• Copied secrets are marked concealed, so clipboard managers skip them, and the clipboard is cleared after a delay.
• Satchel's windows are left out of screenshots, recordings and screen sharing unless you allow them.
• The vault locks after idle time, on sleep and when the screen locks. Locking wipes the keys from memory.

Updates you can check.

Every release is signed with an Ed25519 key. Your copy of Satchel carries the public half and installs an update only if the signature matches, downloaded only from the project's GitHub releases. An update never opens or changes your vault.

What Satchel can't protect.

A vault is honest about its edges. Here is who is kept out, and who isn't.