Application architecture
The application is generated as static files. It contains no server API route, account service, application database, telemetry client, or upload endpoint. Configuration parsing and serialization run in a bounded browser worker. RSA generation uses browser WebCrypto; Ed25519 and ECDSA use a pinned browser cryptography library. Key inspection, protected-container authentication, fingerprint verification, and serialization run in browser code and bounded local workers.
Network boundary
Initial loading, service-worker installation, and update checks use same-origin requests for static assets. Generate, Convert, Diagnose, Copy, Download, and Clear do not send key material or initiate crypto-workflow requests. After one successful load completes precaching, the supported SSH workflows can reload from the saved app shell while offline.
Supported material
Generation supports Ed25519, RSA 2048/3072/4096, and ECDSA P-256/P-384/P-521. Conversion supports the compatible OpenSSH, PKCS#8, and PPK v2/v3 profiles; PKCS#1 applies only to RSA and SEC1 applies only to ECDSA. Fixed input and KDF work limits apply. Format Doctor inspects a broader set of public/private containers and algorithms. Detection does not mean conversion support, and structural recognition does not prove private-key integrity.
Runtime memory
Key values and passphrases remain in page memory only while needed. Passphrase fields are cleared after each attempt and inactivity; Clear removes interface references, terminates KDF workers, revokes download URLs, and wipes tracked byte arrays where possible. JavaScript strings and browser-managed memory cannot be deterministically zeroized by application code.
Offline cache boundary
The service worker caches only versioned HTML, CSS, JavaScript, icons, the manifest, and required crypto worker code. It has no runtime data-cache routes. Pasted keys, generated keys, passphrases, clipboard content, Blob downloads, URLs with user query parameters, and workspace state are excluded. Updates are not activated with a forced reload while sensitive workspace state is present.
Operational guidance
Use a trusted device and browser profile, close unrelated extensions, work on copies, verify fingerprints, protect downloaded files, and prefer established local command-line tooling when organizational policy forbids browser handling of private keys.
Reporting a vulnerability
Send a concise report to [email protected] with the affected route, reproducible steps, expected and observed behavior, and the security impact. Use disposable test material. Do not include private keys, passphrases, production configuration, access tokens, customer data, or other credentials. Please allow reasonable time to investigate before public disclosure.