A user inputted string can be provided at login. Together, the master-key, the inputted string, and the site domain are combined to regenerate the site-specific public-key private-key for that sub-identity.