your password never leaves your device. we receive a derived hash; the master key is derived only in your browser.