The hoard

The hoard keeps what you lock away: passwords, two-factor secrets, private notes and identity documents. It's a separate extension that works alongside midden.

The design

• Two extensions, kept apart by the browser. midden takes in web pages, files and synced data all day. The hoard does none of that. Each has its own storage, and nothing in midden can read the hoard's storage, pages or memory.
• One narrow connection. The hoard listens only to midden, and only for a short, fixed list of requests. No request gets a key, a password or a decrypted item back out.
• Your master password is the way in. It unlocks a key that only ever leaves your device encrypted. We don't hold a copy, and midden never sees it.

How it works

• Encrypted before it's stored. Every item is encrypted on your device. All that stays readable is an item's random ID, its type, its dates, and a public label if you chose to set one.
• Locked by default. The hoard locks itself when it's been idle and when your computer locks. While it's locked, nothing in your browser can read your items without the master password.
• Filled only when you ask. A password goes only into the exact site it was saved for, over https, and only when you ask for it.
• Carried, not opened. Backups and sync carry the hoard still encrypted. midden moves it without being able to read it.
• Hard to lose by accident. A deleted item waits 30 days in a bin. An optional recovery key opens the hoard if you forget your master password.

What it doesn't protect against

• Malware on your machine, or a compromised browser, while the hoard is unlocked.
• The page you fill into: once a password is in a form, that page can read it.
• A forgotten master password, if you didn't make a recovery key.
• Someone who finds your recovery key: it opens the hoard without the password, by design.