--- title: "What a profile password actually protects" description: "Argon2id at 64 MiB and three passes, a random 256-bit database key, and a list of what encryption at rest does not stop. The threat model, written out." url: "https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/" lang: "en" updated: "2026-10-25" --- [ How the figures work, and what the app does with them](https://stonqs.app/blog/) Privacy and your data # What the profile password protects, and what it does not [By Vladimir Varvorkin](https://stonqs.app/about/) Updated October 9, 2026 5 min read Stonqs keeps your portfolio in one file on your own disk. Give the profile a password and that file is encrypted with SQLCipher under a random 256-bit key, which your password only ever unlocks. That stops a stolen laptop and a copied backup. It does not stop four other things. ## On this page 1. [The parameters, since nobody writes them down](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#the-parameters-since-nobody-writes-them-down) 2. [What it protects against](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#what-it-protects-against) 3. [What it does not protect against](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#what-it-does-not-protect-against) 4. [What stays unencrypted on purpose](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#what-stays-unencrypted-on-purpose) 5. [If you forget it](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#if-you-forget-it) 6. [What still leaves your computer](https://stonqs.app/blog/how-the-profile-password-encrypts-your-portfolio/#what-still-leaves-your-computer) Your password does not encrypt the database. That sounds like a problem and is the opposite of one. When you set a password on a profile, the app generates a random 256-bit key and gives it to SQLCipher. Your password is stretched with [Argon2id](https://www.rfc-editor.org/rfc/rfc9106.html) into a second key, and that second key seals the first one in a small file beside the database. Changing your password reseals one 32-byte blob. It never rewrites your portfolio, which can be a hundred megabytes of transactions, and it never leaves a half-converted file behind if the power goes out in the middle. ## The parameters, since nobody writes them down Argon2id, 64 MiB of memory, 3 passes, 1 lane, producing a 32-byte key. That is well above the [minimum OWASP suggests](https://cheatsheetseries.owasp.org/cheatsheets/Password%5FStorage%5FCheat%5FSheet.html) for Argon2id, and the cost is stored per profile rather than compiled in, so it can be raised later without stranding existing files. The sealed blobs are XChaCha20-Poly1305, each bound to its purpose and its profile, so a sealed key copied out of one profile folder into another is rejected rather than quietly accepted. The database key itself is random and already 256 bits, so SQLCipher is handed the raw key and runs no key derivation of its own. There is nothing to guess there: the only thing worth attacking is your password, which is exactly where the 64 MiB and three passes sit. The shortest password the app accepts is eight characters, with no composition rules. That is what NIST SP 800-63B asks for and nothing more, because rules demanding a capital and a digit mostly produce passwords people cannot remember and write on paper. ## What it protects against - A laptop that was lost or stolen while switched off. - Someone copying the profile folder out of a backup, a synced folder or an external drive. - A look at a shared computer by somebody who cannot log in as you. While a profile is locked its database is not open at all. If you let a machine remember a profile, the operating system’s keychain holds the data key, never your password. ## What it does not protect against A security page that promises everything is not worth reading, so here are the limits, in the order we would worry about them. - **Malware running as you, while the profile is unlocked.** The database is open and the key is in memory. Encryption at rest is not a defence against code running inside the session that legitimately has the key. - **Anyone at the keyboard of an unlocked session.** There is no automatic lock after a period of inactivity yet. That is a gap, and naming it is better than implying it is covered. - **A profile with no password.** The database is then an ordinary file that anything can open. The profile list shows which profiles are protected. - **A weak password.** Argon2id makes guessing expensive, not impossible. A memorable passphrase of several words beats a short password with a symbol in it. ## What stays unencrypted on purpose The interface language, the theme, the dashboard layout and your import layouts sit unencrypted next to the database, because the lock screen has to draw itself before you have typed anything. Your transactions, holdings, balances, account names, notes, goals and plans are inside the encrypted file. If that trade matters to you, it is worth knowing that an import layout records which column of your broker’s file meant what, and nothing about your positions. ## If you forget it The data is gone. There is no reset, no recovery file and no back door, and the app says so on the screen where you set the password. Two habits make that survivable: keep the password where you keep your other important ones, and copy the profile folder somewhere safe now and then. The encrypted file copies like any other file, and a copy is as encrypted as the original. Warning A backup of an encrypted profile needs the password to be of any use. A password manager entry and a backup are two halves of the same precaution, and keeping only one of them is the usual way people lose both. ## What still leaves your computer Encryption at rest says nothing about the network, so to finish the picture: requests go out for prices, exchange rates, inflation figures and instrument lookups, to the sources you switched on, and a new profile has every source off until you choose. Beyond that there is a daily update check against the release page, which you can switch off, and the AI assistant if you connect one. Price and rate requests carry a ticker or a currency pair and nothing about you. Your holdings go to nobody. The exception is the assistant, and only the parts you allow it to read, which is [its own subject](https://stonqs.app/blog/what-the-ai-assistant-can-and-cannot-do/). ## Sources - [Stonqs: the profile vault](https://github.com/vvvlladimir/stonqs/blob/v0.5.0/app/src-tauri/src/vault/mod.rs) · The key derivation and the sealed keys, as the app implements them. - [SQLCipher design](https://www.zetetic.net/sqlcipher/design/) · How the encrypted SQLite database is laid out. - [RFC 9106: Argon2](https://www.rfc-editor.org/rfc/rfc9106.html) - [NIST SP 800-63B, Digital Identity Guidelines](https://pages.nist.gov/800-63-3/sp800-63b.html) · Why the only password rule is a minimum length. - [OWASP Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password%5FStorage%5FCheat%5FSheet.html) ## More in Privacy and your data - [What the AI assistant can and cannot do ](https://stonqs.app/blog/what-the-ai-assistant-can-and-cannot-do/) - [What broker CSV exports actually contain ](https://stonqs.app/blog/what-broker-csv-exports-contain/) - [All posts ](https://stonqs.app/blog/) --- [ Stonqs](https://stonqs.app/) A portfolio tracker that runs on your own computer. Free, open source, no account. ## Product [Download](https://stonqs.app/download/) [Privacy](https://stonqs.app/privacy/) ## Learn [Guides](https://stonqs.app/guides/) [Blog](https://stonqs.app/blog/) [FAQ](https://stonqs.app/faq/) ## Project [About](https://stonqs.app/about/) [Source code](https://github.com/vvvlladimir/stonqs) [Changelog](https://github.com/vvvlladimir/stonqs/blob/main/CHANGELOG.md) [Discussions](https://github.com/vvvlladimir/stonqs/discussions) [Report a bug](https://github.com/vvvlladimir/stonqs/issues) Stonqs is a tool for recording and analysing your own investments. It is not financial, tax or legal advice, and neither are the answers of its assistant. Market data comes from free third-party sources with no guarantee of accuracy. This site sets no cookies and loads nothing from other servers; the only thing it keeps in your browser is the language you pick. [Legal notice](https://stonqs.app/legal-notice/) [Privacy policy](https://stonqs.app/privacy-policy/)