The short version
- Your Altwright password is stored as a PBKDF2-SHA256 hash with a per-user salt.
- Session tokens and API keys are stored as hashes, never in plaintext.
- Roblox passwords are generated and kept in your browser, not sent to the server.
- The local vault is encrypted with AES-256-GCM.
Sessions
A session token is 32 random bytes in an HttpOnly, SameSite=Lax cookie. KV stores only a SHA-256 hash. Sessions expire after 30 days.
The local vault
PBKDF2-SHA256 (310,000 iterations) derives an AES-256-GCM key from your passphrase. Ciphertext, salt, and IV are in localStorage. No server copy, no reset.
API keys
Keys are 32 random bytes with an rbg_ prefix. Shown once; only the hash and prefix are stored.