# New secrets are encrypted without a password; reissuing requires decryption

The application must create new clients without requesting a password and require a password to reissue their private keys. Asymmetric encryption was chosen: the vault's public key is available for writing, while its secret key is password-protected. The vault is backed up and restored as a whole without decryption. Password loss is unrecoverable; this scheme does not encrypt the server configuration, original files, or the entire backup archive.