The secret key is combined with the master password. See our white paper here: https://1pw.ca/whitepaper https://1pw.ca/whitepaper See Key Derivation on page

The secret key is combined with the master password. See our white paper here: https://1pw.ca/whitepaper https://1pw.ca/whitepaper See Key Derivation on page 24 for this specifically. We call it 2SKD. Page 26 also shows how the secret key and the master password are combined. From that other keys are derived. It's actually a very fascinating process, combined with our use of SRP, I have to say I rather love how well all of this meshes together. In the situation where someone gets your data from our server, which is the big thing people are worried about, they're going to have to combine a guess for your master password and the secret key to perform a guess. They could in theory get your secret key from your local devices, as these are saved there, but your Master Password protects in that case as it's not stored anywhere (unless you've enabled features like Touch ID or Face ID, but those are protected in other ways). Your Secret Key protects your data on our server. It makes brute forcing that data an incredibly expensive process. Your Master Password also helps protect your data on our server, but it also protects your data locally. Let me know if that helps explain things. Kyle AgileBits