> I do realize there's an independent implementation in Vaultwarden, so that's almost better than a spec -- just as long as Vaultwarden was a clean-room impl and thus reading that code is "legally safe."

Vaultwarden is a server implementation, though.

As the article also points out, the *warden server is little more than a basic REST API, all the cryptographically fun parts happen on the client side, for which there are only the official implementations so far.