Unlock vault

PRF → AES-GCM · plaintext stays in this browser

Authenticate

Touch the fingerprint sensor. No password. Server only stores ciphertext and a PRF-wrapped data key.

Offline recovery
Locked.