diff --git a/keepassxc-protocol.md b/keepassxc-protocol.md
index edfc09d..0dae010 100644
--- a/keepassxc-protocol.md
+++ b/keepassxc-protocol.md
@@ -10,11 +10,16 @@ Now the requests are encrypted by [TweetNaCl.js](https://github.com/dchest/tweet
 5. When KeePassXC sends a message it is encrypted with keepassxc-browser's public key and an incremented nonce.
 6. Databases are stored with newly created public key used with `associate`. A new key pair for data transfer is generated each time keepassxc-browser is launched. This saved key is not used again, as it's only used for identification.
 
+Thus there are three key pairs involved in every communication:
+- `host key` - A temporary key pair created by KeePassXC to encrypt the communication of the current session.
+- `client key` - A temporary key pair created by keepassxc-browser to encrypt the communication of the current session.
+- `identification key` - A permanent key pair created by keepassxc-browser used to authenticate the browser in later sessions after it was successfully *associated* with a database. This one should be stored safely by the browser. Note that only the public key part is ever used which might be a tiny flaw in the protocol since that part is also stored in the database.
+
 Encrypted messages are built with these JSON parameters:
 - action - `test-associate`, `associate`, `get-logins`, `get-logins-count`, `set-login`...
 - message - Encrypted message, base64 encoded
 - nonce - 24 bytes long random data, base64 encoded. This is incremented to the response.
-- clientID - 24 bytes long random data, base64 encoded. This is used to identify different browsers if multiple are used with proxy application.
+- clientID - 24 bytes long random data, base64 encoded. This is used for a single session to identify different browsers if multiple are used with proxy application.
 
 Currently these messages are implemented:
 - `change-public-keys`: Request for passing public keys from client to server and back.
@@ -30,17 +35,17 @@ Currently these messages are implemented:
 
 ### change-public-keys
 Request:
-```javascript
+```json
 {
     "action": "change-public-keys",
-    "publicKey": "<current public key>",
+    "publicKey": "<client public key>",
     "nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
     "clientID": "<clientID>"
 }
 ```
 
 Response (success):
-```javascript
+```json
 {
     "action": "change-public-keys",
     "version": "2.2.0",
@@ -51,14 +56,14 @@ Response (success):
 
 ### get-databasehash
 Unencrypted message:
-```javascript
+```json
 {
     "action": "get-databasehash"
 }
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "get-databasehash",
     "message": "<encrypted message>",
@@ -68,7 +73,7 @@ Request:
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "action": "hash",
     "hash": "29234e32274a32276e25666a42",
@@ -78,16 +83,16 @@ Response message data (success, decrypted):
 
 ### associate
 Unencrypted message:
-```javascript
+```json
 {
     "action": "associate",
-    "key": "<current public key>",
-    "idKey": "<a new identification key>"
+    "key": "<client public key>",
+    "idKey": "<a new identification public key>"
 }
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "associate",
     "message": "<encrypted message>",
@@ -97,7 +102,7 @@ Request:
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "hash": "29234e32274a32276e25666a42",
     "version": "2.2.0",
@@ -109,16 +114,16 @@ Response message data (success, decrypted):
 
 ### test-associate
 Unencrypted message:
-```javascript
+```json
 {
     "action": "test-associate",
-    "id": "<saved database identifier>",
-    "key": "<saved database public key>"
+    "id": "<saved database identifier received from associate>",
+    "key": "<saved identification public key>"
 }
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "test-associate",
     "message": "<encrypted message>",
@@ -128,7 +133,7 @@ Request:
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "version": "2.2.0",
     "nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
@@ -140,7 +145,7 @@ Response message data (success, decrypted):
 
 ### generate-password
 Request (no unencrypted message is needed):
-```javascript
+```json
 {
     "action": "generate-password",
     "nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
@@ -149,7 +154,7 @@ Request (no unencrypted message is needed):
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "version": "2.2.0",
     "entries": [
@@ -165,16 +170,16 @@ Response message data (success, decrypted):
 
 ### get-logins
 Unencrypted message:
-```javascript
+```json
 {
     "action": "get-logins",
     "url": "<snip>",
-    "submitUrl": optional,
-    "httpAuth": optional,
+    "submitUrl": "<optional>",
+    "httpAuth": "<optional>",
     "keys": [
         {
-            "id": <connected_id>,
-            "key": <connected_key>
+            "id": "<saved database identifier received from associate>",
+            "key": "<saved identification public key>"
         },
         ...
     ]
@@ -182,7 +187,7 @@ Unencrypted message:
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "get-logins",
     "message": "<encrypted message>",
@@ -192,7 +197,7 @@ Request:
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "count": "2",
     "entries" : [
@@ -216,7 +221,7 @@ Response message data (success, decrypted):
 
 ### set-login
 Unencrypted message:
-```javascript
+```json
 {
     "action": "set-login",
     "url": "<snip>",
@@ -232,7 +237,7 @@ Unencrypted message:
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "set-login",
     "message": "<encrypted message>",
@@ -242,7 +247,7 @@ Request:
 ```
 
 Response message data (success, decrypted):
-```javascript
+```json
 {
     "count": null,
     "entries" : null,
@@ -256,14 +261,14 @@ Response message data (success, decrypted):
 
 ### lock-database
 Unencrypted message:
-```javascript
+```json
 {
     "action": "lock-database"
 }
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "lock-database",
     "message": "<encrypted message>",
@@ -273,7 +278,7 @@ Request:
 ```
 
 Response message data (success always returns an error, decrypted):
-```javascript
+```json
 {
     "action": "lock-database",
     "errorCode": 1,
@@ -284,14 +289,14 @@ Response message data (success always returns an error, decrypted):
 
 ### get-database-groups
 Unencrypted message:
-```javascript
+```json
 {
     "action": "get-database-groups"
 }
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "get-database-groups",
     "message": "<encrypted message>",
@@ -355,7 +360,7 @@ Response message data (success, decrypted):
 ```
 ### create-new-group
 Unencrypted message:
-```javascript
+```json
 {
     "action": "create-new-group",
     "groupName": "<group name or path>"
@@ -363,7 +368,7 @@ Unencrypted message:
 ```
 
 Request:
-```javascript
+```json
 {
     "action": "create-new-group",
     "message": "<encrypted message>",