The server never gets to see your master password nor the vault key. Every client has a public/private key pair. The private key grants access to the (symmetric

The server never gets to see your master password nor the vault key. Every client has a public/private key pair. The private key grants access to the (symmetric) vault key and will never leave your device. At vault creation time, a copy of the vault key is encrypted using the public key of the recovery group and then stored on the server. The only secret the server ever sees is the secret (device) ID, and that’s by design.