A recovery code that resists brute force.

SciPHR backs up your master key as an encrypted envelope and pins it to public storage. One of the three ways to open that envelope is a recovery code you hold, and the server keeps none of the three. A short code looks guessable, especially with the envelope sitting in the open.

Your device first runs the code through Argon2id, a key derivation function tuned to be slow and memory-hungry. The phone spends real time and a large block of memory to derive that wrap key, once. An attacker testing codes in bulk owes that same cost on every attempt, and the memory demand blocks cheap parallel guessing.

Argon2id trades you one short pause for a search that stays expensive at scale. Tuned high, an attacker pays more in hardware and time than the keys are worth.

An attacker who downloads the envelope still owes Argon2id its full cost on each guess.