- Master password derives an AES-GCM-256 key via PBKDF2-SHA256; the key never leaves the device and the remote only sees ciphertext blobs.
- One file per entry under entries/; conflicts produce a sidecar the user resolves in the UI.
- Vault stays unlocked across background-script suspensions via storage.session; auto-locks after 5 min of inactivity.
