diff --git a/public/browser-toys.html b/public/browser-toys.html
index aafb2d5..a4bc7b7 100644
--- a/public/browser-toys.html
+++ b/public/browser-toys.html
@@ -99,6 +99,7 @@
 
         <h2 id="intro">Browser Toys</h2>
         <p>Browser extensions that add the <strong>uncloseai.</strong> floating button to every web page you visit. Lightweight wrappers around <a href="/uncloseai-js.html">uncloseai.js</a> — no server, no backend, no accounts. The extension injects the script tag, and everything else runs client-side in your browser.</p>
+        <p><strong>Current release:</strong> <a href="https://git.unturf.com/engineering/unturf/uncloseai-browser-toys/-/releases/v1.0.0" target="_blank">v1.0.0</a></p>
 
         <h3 id="extensions">Available Extensions</h3>
 
@@ -143,6 +144,10 @@
         <h4 id="checksums">Verify your download</h4>
         <p>Always verify downloads before installing. Checksum files are generated by the build and published alongside the zips.</p>
         <p><a href="/downloads/SHA256SUMS">SHA256SUMS</a> | <a href="/downloads/MD5SUMS">MD5SUMS</a></p>
+        <h5>v1.0.0 SHA-256</h5>
+        <pre><code>2550bbdd34941b95e7d8944bbf5140b6ef16848c77ce4862f8e52aa9c2091087  uncloseai-browser-toy-chrome.zip
+9b931277112df639fdec830bc43ea86f23b650980dec4c3c012bdec3735f3abc  uncloseai-browser-toy-firefox.zip
+02546524bc9bdab7337274749f4a59caeb1e8b310514ec41d8a7cb54b5661a8e  uncloseai-browser-toy-safari.zip</code></pre>
         <pre><code class="language-bash"># Download checksums and verify all zips at once
 curl -sO https://uncloseai.com/downloads/SHA256SUMS
 sha256sum -c SHA256SUMS
@@ -162,22 +167,27 @@ curl -s https://uncloseai.com/downloads/SHA256SUMS | grep chrome | sha256sum -c<
         <h3 id="storage">Storage and privacy</h3>
         <p>These extensions have no backend. Everything runs client-side in your browser.</p>
         <ul>
-            <li><strong>Chat history</strong> stays in your browser's localStorage, scoped per domain. Conversations on <code>example.com</code> are separate from conversations on <code>github.com</code>. Clear a site's localStorage to clear its chat history.</li>
-            <li><strong>Settings</strong> (model selection, language preference, voice) are stored in localStorage.</li>
-            <li><strong>Secrets</strong> (custom API keys, if you configure them) are protected by UncloseVault.</li>
+            <li><strong>Chat history</strong> stays in your browser's localStorage, scoped per domain and encrypted by UncloseVault. Conversations on <code>example.com</code> are separate from conversations on <code>github.com</code>. Each site has its own vault with its own password.</li>
+            <li><strong>Settings</strong> (model selection, language preference, voice) are encrypted in the vault.</li>
+            <li><strong>Secrets</strong> (custom API keys, unsandbox keys) are encrypted in the vault.</li>
             <li><strong>The extension itself</strong> stores one boolean value: enabled on/off. That is the only data the extension touches.</li>
         </ul>
-        <p>No data leaves your browser except the messages you choose to send to the public machine learning endpoints at <code>hermes.ai.unturf.com</code>, <code>qwen.ai.unturf.com</code>, and <code>speech.ai.unturf.com</code>.</p>
+        <p>No data is written to localStorage unless encrypted with your password. No data leaves your browser except the messages you choose to send to the public machine learning endpoints at <code>hermes.ai.unturf.com</code>, <code>qwen.ai.unturf.com</code>, and <code>speech.ai.unturf.com</code>.</p>
 
-        <h3 id="encryption">Encrypting your chats</h3>
-        <p>UncloseVault encrypts your conversation history, settings, and API keys with AES-256 behind a password you choose. Everything stays in localStorage on your device, encrypted at rest.</p>
-        <h4>How to enable</h4>
+        <h3 id="encryption">Mandatory Vault Encryption</h3>
+        <p>UncloseVault is mandatory. When you first open the chat, you are prompted to create a vault password before anything else. No conversations, settings, or keys are stored without encryption.</p>
+        <h4>First launch</h4>
         <ol>
-            <li>Click the <strong>uncloseai.</strong> button on any page to open the chat</li>
-            <li>Open <strong>Settings</strong> (gear icon)</li>
-            <li>Under <strong>Vault</strong>, click <strong>Create Vault</strong></li>
-            <li>Choose a password (minimum 8 characters)</li>
-            <li>Your settings, API keys, and all conversation history are now encrypted</li>
+            <li>Click the <strong>uncloseai.</strong> button on any page</li>
+            <li>The vault gate appears: choose a password (minimum 8 characters)</li>
+            <li>Chat loads after the vault is created</li>
+            <li>All data is encrypted with AES-256 before writing to localStorage</li>
+        </ol>
+        <h4>Returning</h4>
+        <ol>
+            <li>Click the <strong>uncloseai.</strong> button on any page</li>
+            <li>Enter your password to unlock the vault</li>
+            <li>Your encrypted conversations and settings are restored</li>
         </ol>
         <h4>What gets encrypted</h4>
         <ul>
@@ -190,8 +200,8 @@ curl -s https://uncloseai.com/downloads/SHA256SUMS | grep chrome | sha256sum -c<
         <ul>
             <li>AES-256 encryption via CryptoJS</li>
             <li>Password-derived key with device-specific salt (SHA-256)</li>
+            <li>Each website has its own vault; you can use a different password per site</li>
             <li>Session persistence across page navigations (encrypted session key in localStorage)</li>
-            <li>Plaintext conversations are automatically migrated to encrypted storage when you create or unlock the vault</li>
             <li>Lock the vault at any time from Settings to end your session</li>
         </ul>
         <p>Without the vault password, conversation history and settings are unreadable. If you forget your password, the encrypted data cannot be recovered.</p>
@@ -207,6 +217,7 @@ curl -s https://uncloseai.com/downloads/SHA256SUMS | grep chrome | sha256sum -c<
         </ul>
         <h3 id="source">Source Code</h3>
         <p>📦 <a href="https://git.unturf.com/engineering/unturf/uncloseai-browser-toys" target="_blank">git.unturf.com/engineering/unturf/uncloseai-browser-toys</a></p>
+        <p>Releases: <a href="https://git.unturf.com/engineering/unturf/uncloseai-browser-toys/-/releases" target="_blank">all releases</a></p>
         <p>Build from source:</p>
         <pre><code class="language-bash">git clone https://git.unturf.com/engineering/unturf/uncloseai-browser-toys.git
 cd uncloseai-browser-toys
@@ -251,7 +262,7 @@ node scripts/build.js   # outputs zips to dist/</code></pre>
                     </li>
                     <li><a href="#how-it-works">How it works</a></li>
                     <li><a href="#storage">Storage & Privacy</a></li>
-                    <li><a href="#encryption">Encrypting Your Chats</a></li>
+                    <li><a href="#encryption">Mandatory Vault</a></li>
                     <li><a href="#security">Security Audit</a></li>
                     <li><a href="#source">Source Code</a></li>
                 </ul>