[zokier]

> Passwords are always encrypted using a scrypt key derived from the input passphrase

If this is correct then I'm not sure if it's best approach. My understanding is that in for example keepass there is a separate random key that is used to encrypt the data, and then this key is encrypted using whatever method user uses.

[StavrosK]

Yes, this is so you can change the password without needing to encrypt everything again.