> To unencrypt the full vault and re-encrypt it does take an amount of focused time. The entire vault should not be encrypted directly with the user's password

> To unencrypt the full vault and re-encrypt it does take an amount of focused time. The entire vault should not be encrypted directly with the user's password. That would go against standard best practices. See this comment written hours before yours, right under the comment you replied to: https://news.ycombinator.com/item?id=34127993 https://news.ycombinator.com/item?id=34127993 There is no "big difference" here, and it could be done trivially during login. The fact that it would be done client side instead of server side is a very minor implementation detail.