diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1e2d51a..ac4ea27 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -46,3 +46,24 @@ would plausibly want. Newest first.
   `window.nostr.nip04` — a real NIP-07 extension always has it, so anything
   written against "whatever `window.nostr` provides" may already assume it's
   there. No attribute/config changes needed; this is purely additive.
+
+## 2026-07-22
+
+- **Feature: sessions persist across a page reload.** Previously every reload
+  destroyed the crypto worker, requiring the full login-name + password flow
+  again — re-running Argon2id and a relay quorum read on every navigation,
+  not just the first sign-in. After a successful register/login/recover/
+  changePassword, the everyday private key and active capsule events are now
+  cached in IndexedDB; `connectedCallback()` tries to restore that cache
+  before ever showing the welcome screen, firing `bitlogin-login` exactly as
+  a fresh login would if one is found. Logout clears it. (`9e3787d`)
+  **Security note:** this means the decrypted everyday private key now sits
+  in the browser's IndexedDB for that origin until logout — the same
+  tradeoff every NIP-07 extension and crypto wallet already makes for the
+  same "don't ask for the password every navigation" reason, scoped by
+  IndexedDB's own per-origin isolation. The recovery phrase and login
+  name/password are never cached.
+  **Re-vendor if:** you want this — it's the reason to re-vendor this entry.
+  No attribute/config or host-integration changes needed; a host page's
+  existing `bitlogin-login` listener (see "Embedding BitLogin" below) fires
+  the same way whether the sign-in was just typed or silently restored.
diff --git a/README.md b/README.md
index ab9ebe8..4ec1100 100644
--- a/README.md
+++ b/README.md
@@ -65,6 +65,15 @@ guide, and `packages/demo/public/account.html` for a working example
 (create → confirm recovery phrase → sign an event → rotate password →
 export identity).
 
+**Sessions persist across a page reload.** After a successful sign-in, the
+everyday private key is cached in IndexedDB for that origin, so a later
+reload restores the session and fires `bitlogin-login` automatically —
+your existing listener doesn't need to distinguish "just typed" from
+"silently restored." This trades "nothing persists locally" for "the
+decrypted key sits in this browser's IndexedDB until logout," the same
+tradeoff a NIP-07 extension already makes. Calling `logout()` (or the
+element's dashboard "Log out" button) clears it.
+
 The `<bitlogin-auth>` element also mirrors `window.nostr` directly on the
 element instance (`getPublicKey`, `signEvent`, `nip44Encrypt`, `nip44Decrypt`)
 — prefer this over `window.nostr` when your host page holds a reference to