What is a Secret Key? Two-secret key derivation

A Secret Key is a long random value generated on your device when you create an account, which is combined with your password to derive the key that protects your data, so that neither your password nor the Secret Key alone is enough.

Why two secrets instead of one

Every password-based system has the same weakness: if an attacker copies the server's database, they can try password guesses offline, as fast as their hardware allows. Slow key derivation helps, but a short or reused password can still fall.

Two-secret key derivation adds an input that the server never has. The Secret Key is random, not chosen by a person, so it cannot be guessed from a word list. An attacker with a full database copy would need both your password and your Secret Key. The Secret Key lives only on devices where you have signed in and on the paper or PDF where you saved it.

The idea is well known from 1Password, which describes its Secret Key as working together with the account password and says the company keeps no copy (1Password Support). Crunu's sign-in follows the same model.

How it works in Crunu

• When you create an account, your browser generates a Secret Key of about 128 bits. It is written as K1- followed by groups of 6, 6, 5, 5, 5 and 5 characters. The first group is a tag that identifies the account and is not secret; the remaining 26 characters are the random part.
• Your account key is derived from your password, stretched with PBKDF2-SHA256 at 1,000,000 iterations, together with the Secret Key.
• Neither the password nor the Secret Key is sent over the network in any form.
• On a device you trust, you can choose to remember the Secret Key, so you type only the password. On a new device you enter it once, from your Emergency Kit. Instead of a second-factor code, a new device can also be approved from one where you are already signed in, by comparing a six-digit code.

Changing your password or Secret Key does not re-encrypt your data. A stolen session that is already signed in cannot change the password or delete the account, because both require a signature made with keys from the current password and Secret Key.

Why nobody can reset it

Since the server never learns either secret, it cannot reset your password. Without your password, Secret Key and recovery code, nobody can open the account, including Crunu. The safeguards are:

• the Emergency Kit, a printable sheet with your Secret Key;
• a personal recovery code, R1-…, which releases your keys after a waiting period with a notice to you (one hour by default);
• an organization setting, on by default, that lets admins move a lost account's personal environments to a new account.

See Emergency Kit and Secret Key and recovery code.

Sources

• 1Password Support: Find your Secret Key or Setup Code, checked October 27, 2026.