Is / Where decrypted private key is stored after login?

Community Feedback
#1

Hello,

i would like to try the passbolt app in my company. I have one question though. From my understanding in the login process I enter the passphrase which is used to decrypt my locally stored private key and this key is used to decrypt my secrets. Do I need to enter passphrase each time I want to read a single secret or the decrypted key is stored somwhere in JavaScript?

Best regards

#2

Hello @macedoniusz,

Your understanding is correct. If you click “remember me” the private key passphrase is stored in memory, in the background page (an invisible page on which the core code of the application runs in a sandbox) of the browser extension. The encrypted private key is stored in local storage and memory.

You can learn more about the security model of passbolt in the whitepaper: https://help.passbolt.com/assets/files/Security%20White%20Paper%20-%20Passbolt%20Pro%20Edition.pdf

#3

Thanks for quick answer.

1 Like