When you create an account, it downloads a file which contains

- Your username

- Your password, encrypted with a random key.

That random key (but not your encrypted password) is sent to the server. When you request a password recovery, we send you a file by email which contains that key and with which you can decrypt your password.

That way,

- We don't have your encrypted password

- A random person / application can't grab your password from your computer

- We verify that it's you who wants a password recovery (by sending you an email).