How does the E2E work in terms of user flow? I assume a you need a password?

Do you need to enter the password every time you open this?

You can start using it right away without a password (it will generate a random one and use it only once to encrypt a DEK key). Once you create an account with a password, it re-encrypts your DEK and uploads it to Supabase (encrypted). Later on you only need to enter your password again if you sign out and want to sync with other devices.