File: 1783149559542605.jpg (55 KB, 1131x636)

55 KB JPG

Brave just introduced Brave Accounts”and they’re doing password auth differently from basically every normal website.

The interesting bit: your password is never sent to Brave’s servers. Not plaintext, not encrypted, not hashed. It never leaves your device.

They’re using OPAQUE, a relatively new password-authenticated key exchange (published as RFC 9807 in 2025). During signup/login, the client and server perform an OPRF-based cryptographic exchange that lets the client prove it knows the password without revealing it.

The server stores cryptographic material derived from the password + a server secret, rather than an encrypted copy/hash of the password itself. Argon2id is also used to make password guessing expensive.

Why this matters:

No plaintext password ever reaches Brave’s auth infrastructure less risk from logs, memory scraping, compromised auth components, rogue insiders, etc.
A stolen password database isn't immediately useful for mass offline cracking.
The server-side secret prevents attackers from doing huge precomputed password dictionaries in advance.
Offline guessing after a full compromise is still possible, but it becomes a per-user, expensive grind.
OPAQUE also produces an export key, which can potentially be used for E2E-encrypted data without Brave ever possessing the encryption key.

They’re planning to use this as the foundation for things like Email Aliases and potentially Brave Sync, including password-based bootstrapping of E2E-encrypted sync on new devices.

Obviously it isn't magic: phishing can still steal your password before OPAQUE runs, weak passwords are still weak, and a fully compromised server can still allow offline guessing.

But conceptually this is pretty fucking cool: instead of asking users to trust the server with their password and hoping the password database/auth stack never leaks it, the protocol is designed so the server never gets the password in the first place.