Aah ok. I was under the impression that there was always a master key, and it was unencrypted until you added a passphrase.

unencrypted wallet.dat just stores private keys (amongst other things).

Encrypted wallet.dat has private keys which are encrypted with a master key (that was not there before it was encrypted), which itself has been encrypted with the derived_key thats made from the password.

Very elegant. You can store the decrypted master key in memory, and while you may be able to extract that, it wont get your the password nor be useful on any other wallet. That makes the nerd in me happy (while the financial advisor inside is still upset

Thanks again, amazing explanation.