Questions about Using Secrets

I have successfully moved all of my magichome and sonoff devices off of the cloud using ESPHome. I have some questions about using the secrets option, however.

First, is the secrets.yaml that is created in the esphome directory stored on each individual device? Or do they read back to the API and update when the secrets.yaml gets updated?

Secondly, if the secrets.yaml file is NOT stored on each individual device, when I want to update the wifi password, for example, I assume all I would have to do is restart the addon and restart the devices?

No. The secret is looked up at compile time and compiled into the bin file as the value.

Nope. You have to recompile an reupload to all the devices.

The secrets file is only used to prevent sensitive information leaking out when the text/yaml file is backed up to places like github or shared online in forums.

Is the wifi password shared with PlatformIO or is it compiled locally?

If you don’t use windows, android or a apple thingy it should not be shared :bulb:

If you ever shared your wifi password with a windows, android (except “ungoogled” aosp versions) or a apple thingy your passphrase is in the clouds already :cloud:

esphome compiles it locally without any clouds involved :no_entry_sign::cloud:

Thank you for the reply.

Yes, my password and a lot of information is already shared. I wanted to understand if it was shared in yet another place.
Thank you very much for clarifying