How your encryption works
A cartridge only performs if every component is right — the case, the primer, the powder charge, the projectile. Miss one and the rest does not matter. Your permits work the same way, and the component you control is the one that decides everything.
The Encryption Lab
Loading the lab…
Time to break in
Assume the worst case: someone has stolen the encrypted file, they are grinding away offline where nothing can rate-limit them, and they know exactly how we derive keys. Here is how long each kind of password holds.
This page describes end-to-end accounts — the ones whose sign-up showed a recovery code. Older accounts work differently, and the note near the end of the page says how.
It is already in a cracking list. Nobody brute-forces it; they look it up.
Capital, symbol, digit — it passes every strength meter and follows three patterns a cracker tries first.
Against someone who knows you — an ex, a sibling, a roommate. The people most likely to want into your account already have most of the answers.
Random beats clever — four words already beats Mustang!7 by a factor of sixty thousand. It is still not enough, which is why our own generator will not hand you four.
One more word moved it from months to centuries. This is the floor the generator starts you above, not the target.
What the generator gives you by default, and still seven things you can picture in a row.
This is why the recovery kit is the one thing we tell you to print and put somewhere physical. It is not slowed by the memory-hard key derivation that protects a passphrase; 160 random bits does not need it, and is out of reach at any guessing speed.
Not a big number — a different category. Counting to 2²⁵⁶ would take more energy than the sun will ever emit. This is never the part anyone attacks.
Priced at one million guesses per second — a rented cluster several hundred times faster than a high-end graphics card actually manages against our key derivation, which is memory-hard by design and lands around 2,000–3,000 guesses per second in practice. Times are expected-case, meaning the attacker finds it halfway through on average. We use the unfavorable number on purpose; a table like this is only worth reading if it errs against the people who published it. The recovery-code and key rows are not slowed by the key derivation at all; they need no help, because 160 and 256 random bits are out of reach at any speed.
Where the jump happens
Look again at the table and find where it stops being measured in months. It is not at a stronger algorithm. It is between word four and word six — the part nobody else can do for you.
Our key derivation buys you about twenty bits. Roughly two free words. It turns four words from minutes into months. It cannot rescue a bad password.
The lab above is the real thing, not a mock-up: the same 2,048-word list and the same arithmetic the generator inside your account uses, which is where the 11 bits per word above comes from. Nothing you type or roll is sent anywhere — the words are drawn by your own browser, and this page has no database to send them to. And a passphrase you did not choose yourself is the entire point: a word you picked because it means something to you is a word that someone who knows you can guess.
The components
Handloaders already understand this page. You do not trust a round because the box says so — you trust it because you know what went into it and you measured the charge yourself.
The component we never see, never store, and cannot reproduce. Everything downstream is ignited by it, and nothing downstream can compensate for a weak one.
Measured deliberately heavy. Each guess an attacker makes has to allocate 64 MiB of memory and work through it — which is what drags a graphics card from ten billion guesses a second down to a few thousand.
The cipher that actually does the work, on your device, before a single byte leaves it. Nobody attacks this part. It is not the weak component in any real break-in, which is exactly why we spent this page on the primer instead.
160 random bits your own device generates once and shows you once. It is the other way to unlock your permits if you forget your password. Keep it on paper in a safe, not in your email.
The honest part
Encryption is a specific tool for a specific job. Any page that tells you it solves everything is selling something. Here is the actual boundary.
If you take one operational thing from this page: the passphrase protecting your permits should be used for this and nothing else, and your recovery kit should live somewhere physical. Those two habits matter more than every technical decision listed above.
What we can actually see
Plenty of products say "zero knowledge" and mean it loosely. Here is the specific, checkable version, including the parts that are not encrypted.
If a court orders us to hand over everything we have, on an end-to-end account we hand over what the Privacy Policy describes in Section 1 — your email address, your home state and name if you gave them, counts and dates of your permits, sign-in times and IP addresses with their country and region, any support correspondence — and a pile of ciphertext we cannot open. That is not a promise. It is the shape of the system.
Older CaliberBase Carry accounts — the ones whose sign-up did not show a recovery code — work differently. Their permits are encrypted on our servers under a key we hold, so we can read them, and each permit's issuing state and expiration date are stored unencrypted. Those accounts still work exactly as before. The Privacy Policy lists what we hold for both kinds.
Your permits, your ledger
This is a record of the permits you hold, kept the way that kind of record ought to be kept: by you, readable by you, on terms you set. Not a registry. Not a database someone else queries. Not a product that studies your permits to sell you something. On an end-to-end account you hold the key, and the arithmetic on this page is what that sentence is worth.