The key (which is generated from the password), is stored using localStorage while the user has the app unlocked. I could certainly send myself the key somehow, but the concerned user should be able to snort that out fairly easily. I guess one option would be to opensource all or part of the js.