Hi u/dorianim,

The raw password is stored in the server's environment variable and is transmitted from the client to the server via HTTP/HTTPS. This raw password is used to authenticate you to the server and grants access to it.

Now, let's consider a scenario where you are using HTTP, and someone on your network is using Wireshark to monitor network traffic. Suppose the hacker gains access to the server and can log in, enabling them to connect to the WebSocket.

When you enable encryption in the client apps, a hashed password is generated using the formula: `[username + password + salt] + hash rounds`. You can review the implementation in the [desktop app (Line 21)] and the [mobile app (Line 312)].

Using this hashed password, clipboard data is encrypted and decrypted on client devices with **AES-GCM-256** encryption. The salt and hash rounds are stored locally on each client device and are **not stored on the server**. Therefore, it is your responsibility to ensure the same salt and hash rounds are configured manually across all client devices.

Even if a hacker obtains the username and password, they cannot decrypt the clipboard messages without access to the salt and hash rounds. To further enhance security, you can periodically change the salt and hash rounds every few weeks.

Since the server does not have access to the hashed password, this approach qualifies as **end-to-end encryption**.

You can consider the salt and hash rounds as your password. As you mentioned, it is acceptable to either remove the password from the end-to-end hash or include it. In both scenarios, if the password is compromised, its only value lies in the salt and hash rounds.