Optional, private account
An account that stays on your device.
This is not an account on our servers. Your address, wishlist and order history are encrypted with a key derived from your password and stored in this browser only. We cannot read them, and neither can anyone who copies your storage without the password.
How it is protected
Passwords are never stored. Sign-in checks a PBKDF2-SHA-256 hash with 210,000 iterations and a unique random salt.
Your data is encrypted. A separate password-derived key encrypts the record with AES-GCM, with a fresh initialisation vector on every write.
The key is not left lying around. It lives in session storage and is removed when you sign out, so a copy of local storage alone reveals nothing.
Nothing leaves the device. No account data is transmitted to us, ever. Privacy policy.
Signed in on this device