I’m not sure; would you consider that a good thing or a bad thing for this purpose? If you consider it a bad and a security risk, then I would answer that the

I’m not sure; would you consider that a good thing or a bad thing for this purpose? If you consider it a bad and a security risk, then I would answer that the RSA private key would still be protected by a master password on the client side. You essentially end up with a solution like LastPass or 1Password with a different password for each service, with the added benefit that the server only has the public key so users aren’t affected if attackers obtain a copy of the server database. If a good thing, well, it’s not clear to me that Foamicate syncs across browsers either.