How Velio protects your lists

Your lists hold addresses and logins that are yours. Velio keeps them so that your TVs can have them, without being able to read them.

Your password

Your browser turns your password into two keys, with Argon2id (64 MiB, 3 passes) and a salt of your own. One key signs you in: Velio keeps only a hash of it. The other opens your account's keys, which Velio keeps sealed under it. Your password and that second key never leave your browser.

Your lists and profiles

Each list and each profile is encrypted in your browser with a key of its own (XSalsa20-Poly1305), before it's sent. Your browser signs the account's list of what exists (Ed25519), so a TV or another browser can tell if anything was changed, added, dropped or swapped on the way.

This browser also remembers the newest version of your account it has opened, and refuses an older one. That stops a server from quietly undoing a change, such as bringing back a TV you removed. A browser that has never opened your account can't tell, so make changes from one you use often.

Your TVs

A TV makes its own keys, and gets only the keys of the profiles you give it. The QR code it shows carries a secret that goes from the TV to your phone without passing through Velio, so Velio can't slip in keys of its own. The code you can type instead is shorter: a hostile server could work it out in days, though not within the 10 minutes it lasts. Scan the QR code when you can.

When you remove a TV or take a profile from it, your browser makes new keys for what it could read, so it can't read anything you change after that. It may still have what it had before.

A forgotten password

Velio can't open your lists, so it can't give them back. Without a recovery key, resetting the password deletes your lists and profiles. With a recovery key and the reset email, you keep everything. Keep the recovery key away from the devices you use Velio on.

What Velio can still do

Velio sends the page your browser runs. If Velio itself were taken over, the page could be changed to send your password elsewhere: that's true of any service you use in a browser. Pages run only code from velio.tv, plus Cloudflare's Turnstile check on the sign-up and reset pages, under a strict Content-Security-Policy, and only over HTTPS.

Velio knows your email address, your TVs' names, how many profiles and lists you have, and when things happen. See Privacy.

A copy for you

On Your lists, you can download your lists and profiles as a file. Your browser makes it from what it has opened. It isn't encrypted, so keep it safe.