Random credentials
The SMTP username contains 18 random bytes encoded as base64url. The password contains 32 random bytes, providing 256 bits of source randomness.
Separate derived keys
scrypt derives independent 32-byte materials for encryption and password verification using distinct purpose strings and a random 16-byte salt.
Authenticated encryption
The access token, refresh token, expiration time, and granted scope are serialized and encrypted with AES-256-GCM using a random 12-byte nonce. The database stores ciphertext, nonce, authentication tag, salt, and verifier.
Why a password cannot be recovered
The plaintext generated SMTP password is not stored. It must be supplied by the SMTP client to verify the credential and derive the token-decryption key. A lost password requires revoking and recreating the connection.