From 154a0f7bedaf0950c63a56143e24f244396a730f Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Tue, 1 Jul 2025 18:49:19 -0400
Subject: [PATCH] docs: explain encryption mode

---
 README.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/README.md b/README.md
index bb41e05..cadfdac 100644
--- a/README.md
+++ b/README.md
@@ -136,6 +136,30 @@ python src/main.py
    Enter your choice (1-5):
    ```
 
+### Encryption Mode
+
+Use the `--encryption-mode` flag to control how SeedPass derives the key used to
+encrypt your vault. Valid values are:
+
+- `seed-only` – default mode that derives the vault key solely from your BIP-85
+  seed.
+- `seed+pw` – combines the seed with your master password for key derivation.
+- `pw-only` – derives the key from your password alone.
+
+You can set this option when launching the application:
+
+```bash
+python src/main.py --encryption-mode seed+pw
+```
+
+To make the choice persistent, add it to `~/.seedpass/config.toml`:
+
+```toml
+encryption_mode = "seed+pw"
+```
+
+SeedPass will read this value on startup and use the specified mode by default.
+
 ### Managing Multiple Seeds
 
 SeedPass allows you to manage multiple seed profiles (previously referred to as "fingerprints"). Each seed profile has its own parent seed and associated data, enabling you to compartmentalize your passwords.